Meta pauses Muse chat sharing after 6,800+ share links turned up in DNS records
Sorted AI22 OctSecurity firm Claroc found that Meta's Muse assistant put each shared conversation's title into the share link's web address, which public DNS records then logged. One search of a commercial passive-DNS service returned more than 6,800 share addresses, and the pages opened without a login. Of the few hundred Claroc opened, most were harmless, but some held a small-business loan application, a CEO-only revenue review and a full-year staff vacation calendar. Claroc reported it to Meta on 8 October; after Ars Technica asked, Meta said on 20 October it is suspending the feature, though the old addresses and titles stay in DNS history.
Why it matters: Treat any AI share link as a public page: tell your team not to share work chats by link. If staff use Muse, ask what they shared; Claroc suggests blocking muse.ai and metaaiusercontent.com on managed devices if you cannot monitor it.
Claroc ↗AI-assisted, reviewed by Sorted AI
▲ 0
0 comments