Meta pauses Muse sharing after DNS leak

Meta paused the sharing feature of its Muse AI assistant after security researchers found that links to shared artifacts could be reconstructed from passive DNS records, potentially exposing sensitive documents.

The flaw lay in the way Muse generated share URLs: each contained a descriptive title and a random identifier in the hostname, which passive DNS services logged when browsers requested the page.

Claroc, the security firm that identified the issue, catalogued more than 6,800 share hostnames and examined a few hundred pages. While most were harmless, some contained business loan applications, marketing revenue reviews, workplace calendars and private financial details.

Meta responded by pausing sharing, issuing a fix that changes the URLs for any artifacts shared before the correction, and apologizing for the disruption. The company thanked the researchers and reminded users of its bug bounty program that can reward up to $300,000 for valid findings.

After implementing the fix, Muse’s sharing function was restored. Old links now redirect to a notice that asks users to obtain the new URL, while the new links remain active only for those who were originally intended to see the content.