Meta Muse AI chat links leak 6,800 logs via passive DNS

Meta Muse AI has suspended its conversation-sharing feature after cybersecurity researchers revealed that more than 6,800 shared chat URLs were discoverable through passive DNS queries. Designed for consumers and professionals handling personal tasks and work workflows, the tool allowed public links without login barriers—creating a significant privacy flaw where sensitive financial documents, corporate files, and meeting preparations were exposed, with historic DNS records remaining queryable even after the web pages went dark.

Cybersecurity research team Claroc disclosed the findings in a report published on October 18, noting that the exposure stemmed from how the personal AI assistant configured shareable web addresses. Instead of generating randomized, unguessable strings, Muse incorporated the user's conversation title directly into the subdomain hosted under cf.metaaiusercontent.com. Whenever a user or an intended recipient loaded the link, public passive DNS logging systems recorded the generated hostnames into publicly searchable historical databases.

Sensitive Corporate and Personal Records Exposed

Through a single passive DNS query, Claroc researchers retrieved hostnames for over 6,800 shared pages. A spot check of several hundred active links showed that viewing the conversations required no Meta account credentials or authentication. Anyone with the discovered URL could inspect the entire chat history in plain text.

The exposed contents contained a wide range of highly confidential records. Researchers uncovered enterprise revenue review documents, small business loan applications, bank fraud warnings, real estate investment summaries, and internal company leave calendars. In one instance, the researchers located detailed preparation notes compiled by a candidate interviewing with the head of a frontier AI lab, complete with internal contact details and meeting schedules.

Meta Suspends Link Access While DNS Footprints Remain

Claroc initially alerted Meta to the vulnerability through its bug bounty program on October 8. A Meta spokesperson responded that users are permitted to generate link-accessible pages for specific Muse interactions, but confirmed that the company halted the sharing functionality while reviewing the findings and evaluating how to manage URL discoverability.

In a follow-up assessment released on October 20, Claroc re-tested 40 links that had previously been accessible without authentication and found that all had been disabled, returning server errors. While the live pages are no longer serving chat logs, the generated subdomains and conversation titles remain archived across third-party passive DNS logs, meaning the shutdown does not scrub historical footprints.

Claroc noted that its investigation targeted a specific domain pattern and discovery mechanism, meaning the full scope of exposed Muse chats across other channels remains unquantified. The research team found no evidence that malicious actors systematically collected or exploited these URLs before the fix was deployed.

How comfortable are you sharing AI-assisted meeting notes or financial summaries using built-in web links, and should platforms enforce mandatory access controls on every generated URL?