Meta pauses Muse sharing after Claroc says it found more than 6,800 links
🎧 Listen to this story
Meta paused the feature that lets users share conversations and other artifacts from its Muse AI assistant through links. Researchers at security firm Claroc say they found more than 6,800 of those links in public DNS records and accessed hundreds of pages, including content containing a revenue review, a loan application, a full-year staff vacation calendar, and notes for a conversation with a job candidate.
According to Ars Technica, the URL format—which combined a conversation’s title, a short description, and a random identifier—made the links easier to discover through passive DNS services. Meta said it suspended the functionality while reviewing the report and considering changes to how the links can be found. Claroc co-founder and CTO Asaf Aprozper told Ars Technica that he reported the issue through Meta’s bug bounty program on October 8.
Why it matters · editorial interpretation
The case highlights the risk of treating shareable assistant links as private: Claroc says hundreds of pages contained professional and personal information. Meta’s pause indicates that how easily the links could be discovered is part of the feature review.
Sources
Security