Muse's chat-sharing links were discoverable via passive DNS, exposing 6,800 conversations including loan applications and a bank fraud alert

Meta Muse users·Meta Muse

Muse built shared-conversation URLs by embedding the chat's own title into a subdomain of cf.metaaiusercontent.com; because that hostname gets logged in public passive-DNS records, security firm Claroc enumerated roughly 6,800 share links with a single passive-DNS query and opened hundreds of conversations users never intended to be public.

Blast radius

6,800 share links enumerable; a sample of opened conversations included a small-business loan application, a bank fraud alert with a partial account number, a company revenue review for a CEO, confidential executive-search notes, and a full-year staff vacation calendar. Claroc said it found no evidence of misuse.

Root cause

Using a user/AI-generated conversation title as part of a public identifier (subdomain) made nominally 'anyone with the link' shares discoverable without the link, instead of relying solely on an unguessable random token.

How it was caught

Claroc researchers found the links via a single passive-DNS search and reported it through Meta's bug bounty program on October 8.

What changed

Meta paused the Muse chat-sharing feature while it reviews the report and considers changes to the URL scheme.

Take-awayNever embed user or AI-generated content (like a title) into a public identifier such as a URL/subdomain for anything meant to stay private — DNS requests are effectively public record.