Meta suspends Muse chat sharing after DNS flaw exposed 6,800 conversations

Meta has suspended the chat-sharing feature of its Muse agentic AI platform after security researchers enumerated 6,800 shared conversations and read private details inside them. The company disabled the feature following a disclosure by researchers at security firm Claroc, which found that anyone could potentially access the links users created to share their Muse chats.

Muse debuted last month. The bug findings landed within weeks of release, and they concern the platform's most basic sharing mechanism rather than an exotic attack vector.

What exactly did the researchers find?

Users shared Muse conversations by generating a URL. Claroc discovered those URLs could be found and opened through a passive DNS search, because every sharing link used the same domain name and embedded the conversation's title in the subdomain.

Passive DNS records capture how human-readable domains resolve to the IP addresses browsers use. The records function, in effect, as a phone book for the internet, and they accumulate history. Once a shared-chat subdomain was written into DNS, it became discoverable by anyone querying those records.

"Muse names each share's web address after the conversation's own title, and that address is written into public DNS," Claroc explained in a blog post. "One passive-DNS search brings back thousands of them, listed by name, like a table of contents."

What kind of information was exposed?

Claroc enumerated 6,800 links to shared Muse chats. The researchers viewed private information from both business and personal uses of the service. The exposed material included:

• meeting times with a frontier AI lab
• a small-business loan application
• a bank fraud alert containing partial account details
• a company's vacation calendar
• other internal company documents

The list demonstrates the gap between what users treat as private working sessions with an AI agent and what a shareable link actually discloses when its address leaks into public infrastructure. Agentic AI platforms such as Muse are designed to handle exactly this category of sensitive material — calendars, financial documents, internal planning — which raises the stakes of a discovery flaw in their sharing layer.

Ars Technica first reported on Claroc's findings.

What did Meta do?

In a statement to Ars Technica, Meta said: "we've paused this functionality while we review this report and consider changes to how these links can be discovered."

Claroc also noted that its researchers were unable to open a sampling of the links they had previously accessed following Meta's update. That suggests the pause cut off access to at least some already-shared conversations, not only the creation of new links.

The company has not publicly detailed what replacement mechanism, if any, it intends to ship.

Why does this matter beyond one feature?

The flaw sits in a design choice, not a broken implementation. Deriving share URLs from conversation titles and writing them into public DNS made every shared chat enumerable by name. Enumeration of this kind does not require an attacker to compromise an account or exploit a memory-safety bug; it requires only a passive DNS query.

For Meta, the incident lands during the early adoption window of Muse, when enterprises are deciding whether to route operational data through agentic AI tools. The exposed items — a loan application, a fraud alert, an internal vacation calendar — are precisely the documents that determine enterprise trust in such platforms.

The episode also illustrates a recurring pattern in AI product rollouts: sharing features ship as conveniences, and their addressing schemes receive security scrutiny only after third-party researchers test them. Claroc's 6,800 enumerated links arrived within roughly a month of the platform's debut.

Meta's next move — whether it returns sharing links behind authentication, randomizes identifiers, or removes DNS-visible addressing entirely — will signal how the company weighs sharing convenience against enumeration risk across its AI products.