Meta re-enables Muse sharing after flaw made links easy to find
🎧 Listen to this story
Meta re-enabled Muse sharing after security researchers at Claroc reported that public links to conversations could be discovered through public DNS records. The company had paused the feature after being contacted about the issue and now says the flaw affected URLs for “artifacts” such as documents and images, not chat sharing itself. Previously shared artifacts received new URLs; anyone opening an old link will see a notice telling them to request the new address from the sender.
According to Wired, Claroc was able to enumerate 6,800 links and opened several hundred, finding information that apparently was not meant to be public, including an internal revenue review, a loan application and partial bank-account data. The researchers said the addresses were easy to discover because they included conversation titles in subdomains of cf.metaaiusercontent.com.
Why it matters · editorial interpretation
The incident may prompt users to review previously shared artifact links and highlights the importance of separating conversation sharing from access to linked documents and images. Meta’s described fix invalidates old URLs, but requires senders to distribute the new addresses.
Sources
Security