Researchers found 6,800 Muse share links via public DNS, and Meta paused sharing

Links that Meta Muse users created to share conversations could be found by anyone, security firm Claroc said. Ars Technica reported on October 20 that the researchers were able to enumerate 6,800 such links. The cause is a design choice: each link puts the conversation title into the subdomain of the address, and public DNS records, searchable through commercial passive-DNS services, expose it. “It took one query,” the researchers wrote.

After opening a few hundred links, Claroc found material that was clearly not meant to be public, including a loan application with the amount requested, a to-do list with a bank fraud alert and a partial account number, and notes for a confidential executive-search call. Claroc says it reported the problem to Meta’s bug bounty program on October 8 and got no reply. Meta told Ars it has “paused this functionality” while it reviews the report and considers changes to how the links can be discovered.

What this does not show: the examples Ars lists are business and personal-finance data. Ars does not report intimate chats among them, and Fox News, in a CyberGuy column of October 23, stresses that the problem concerned content users had shared by link, not all private Muse conversations. The same column notes that Muse is an 18+ app, and describes age checks that, per Meta’s documentation, include a date of birth, a look at linked Facebook or Instagram accounts and, if needed, a credit card. Sexually explicit chats are allowed for adults, as we reported on October 18, so whether any sexual conversations were among the shared links is an open question.

Muse remembers users and acts on their accounts, which is why the question matters: see relationship memory.