Meta has temporarily turned off the sharing feature of its Muse AI platform after researchers uncovered a privacy flaw that exposed personal and business information. The issue came to light when security firm Claroc examined the way Muse generated URLs for shared conversations. Each share link incorporated the conversation’s title as a subdomain under a common domain, making the addresses searchable through passive DNS records—a public database that maps domain names to IP addresses.
Claroc explained in a blog post that a single passive‑DNS query returned thousands of URLs, effectively creating a table of contents for shared chats. The firm was able to list about 6,800 such links and view content from both corporate and private users. Among the exposed data were meeting schedules with an advanced AI research lab, a small‑business loan application, a bank fraud alert containing partial account numbers, a company’s vacation calendar, and other internal documents.
Ars Technica first reported Claroc’s findings. When contacted, Meta said it had “paused this functionality while we review this report and consider changes to how these links can be discovered.” Claroc added that after Meta’s update, its researchers could no longer access a sample of the previously retrieved links.