Meta Pauses Muse Chat Sharing After Researchers Find About 6,800 Share Links Through Public DNS
Security firm Claroc says it found about 6,800 Muse conversation share links via passive DNS because each link's web address included the conversation title, Ars Technica reports. Opened shares included loan applications, internal revenue reviews and staff calendars. Meta told Ars and The Verge it has paused sharing while it reviews the report.
Share-by-link is only as private as the hostname design. Security firm Claroc says it found about 6,800 links that Muse users had created to share conversations, by running a passive DNS search, Ars Technica reported on Tuesday, October 20. Each share's web address included the conversation's title, and DNS monitoring services recorded those addresses once links were opened, which let outsiders find them, Claroc told Ars and The Verge.
After opening a few hundred shares, Claroc found material Ars summarises as including a small-business loan application, a marketing company's internal revenue review, a real-estate investor's performance report, a workplace's full-year staff vacation calendar, and a candidate's notes for a confidential call with a frontier AI lab.
Claroc's CTO told Ars he reported the findings through Meta's bug bounty on Thursday, October 8 and got no reply. A Muse spokesperson told The Verge Meta has paused the sharing functionality while it reviews the report and considers changes to how the links can be discovered; Ars carried a matching Meta statement. We covered earlier Muse KVM-escape findings separately.
Limits
- Claroc's own write-up was not opened; research details are as reported by Ars and The Verge.
- Exposed-chat examples are given as categories from Ars; the underlying chats were not re-opened here.