MENLO PARK, Calif. (Diya TV) — Meta paused a Muse feature that creates shareable chat pages after security researchers found more than 6,800 Muse link addresses in a commercial passive-DNS database. The researchers opened a few hundred pages and found some containing sensitive personal and business information.
The pages included a small-business loan application, a company revenue review marked for its chief executive, a real-estate investor’s performance report and a workplace calendar listing employees’ vacation weeks. Researchers also found notes for a candidate preparing for a confidential call with an artificial-intelligence lab. Most of the pages they checked, however, contained unremarkable material.
Claroc, the security firm behind the findings, identified 6,800 share hostnames. That count does not represent 6,800 victims or 6,800 sensitive documents: researchers opened only a few hundred links and found sensitive information on dozens of pages. Claroc said it had no evidence anyone had misused the material.
Muse creates a web page when a user asks it to share a conversation. Anyone with the link can view that page, but Claroc found that people did not need to receive a link directly to find some pages. Muse built each address from the conversation title and a random ID under the same domain. When a browser opened a page, passive-DNS services could record its hostname, leaving the title and link searchable in a commercial database.
This was a flaw in link discoverability, not evidence that researchers broke into Muse accounts or accessed unshared conversations. But the design made pages users had chosen to share easier to find beyond their intended recipients.
Claroc reported the issue through Meta’s bug-bounty program on Oct. 8. Meta paused the sharing feature on Oct. 20 and said it would review the report and consider changes to how people could discover the links. Claroc later checked 40 pages that had previously opened without an account; none loaded, though their hostnames remained in DNS records.
Meta introduced Muse in September as a personal AI agent that can handle tasks such as sending emails and booking travel. The company described it as private and said it runs in a dedicated virtual machine. The reported issue involved Muse’s optional sharing feature, which Meta has now suspended while it reviews the link system.
