Claroc finds more than 6,800 Muse share links via public DNS records, prompting Meta to pause the feature
The Verge reported Oct 20 that security firm Claroc discovered more than 6,800 Meta Muse share links through public DNS records and read hundreds of conversations, including a company revenue review, a loan application, a staff calendar and recruiting notes. Meta spokesperson Tracy Clayton said the feature has been paused while the report is reviewed.
The Verge reported on Oct 20 that Meta has paused Muse's conversation sharing feature. Security firm Claroc found more than 6,800 Muse share links by querying public DNS records and successfully read hundreds of the conversations. The report specifically names a marketing company's revenue review, a small business owner's loan application, a workplace full-year staff calendar, and notes from a call with a job candidate at an AI lab. That means what surfaced was not just personal chat but business financials, loan paperwork, internal staffing plans and recruiting information.
The core issue is link discoverability. Muse let users share a specific conversation or artifact via link, with access resting mainly on whether you had the URL. But each share link is built from a user-set title or short description plus a random ID, and the domain typically reveals the conversation topic directly. Researchers could pull the domain from public DNS records, and because the domain and the actual link contain the same title and ID, the full URL could be reconstructed from the DNS data alone. Claroc put it as the domain usually revealing the page contents before the page is even opened.
From a privacy standpoint, the report describes no server breach and does not say the links were set to be fully public. What it describes is link-gated content whose secret URLs were weakened by predictable, enumerable information, making bulk discovery possible. The report only confirms that hundreds of conversations were read, and does not mean all 6,800-plus links were confirmed read.
Meta spokesperson Tracy Clayton said users can share specific Muse artifacts, creating a page accessible to anyone with the link, but that the company has paused the functionality while it reviews the report and considers how these links can be discovered. The piece does not say when the pause will lift, whether exposed links are being taken down in bulk, whether sharers will be notified, or whether access controls, warnings or search-index restrictions will be added.