GoKawiilMeta suspends Muse AI sharing feature after researchers expose private chats via DNS
Security researchers at Claroc found that Meta's Muse AI assistant embedded conversation titles in subdomains, making shared chat links discoverable through public passive DNS records. The firm enumerated roughly 6,800 shared Muse conversation links with a single DNS query and found sensitive personal and business information inside many of them. Meta has suspended the sharing feature while it evaluates changes.
GoKawiil's interpretation of the reporting above, not reported fact.
The incident undercuts Meta's marketing of Muse as being 'built from the ground up for privacy and security,' since a basic architectural choice—putting identifiable titles in subdomains—made private data trivially discoverable rather than requiring any hacking skill. It also highlights a broader risk for AI products that generate shareable links, where developers may overlook that DNS infrastructure itself can leak metadata about supposedly private content.
- Muse's shared-conversation links were discoverable via passive DNS lookups, not just guessing.
- Researchers accessed thousands of shared conversations containing sensitive personal and business details with minimal effort.
- Meta has paused the sharing feature while reviewing how to fix the exposure.
Source: yro.slashdot.org, 2026-10-20
Published there as: “Meta Muse Exposes Users' Personal, Business Secrets When They Share Conversations”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.