Meta Muse shared-chat URLs exposed 6,800+ private conversations via DNS logs

Security firm Claroc found that Meta's Muse AI assistant built share URLs by embedding the conversation title in a subdomain alongside a short random code, making links discoverable through passive DNS lookup services without ever receiving the link. Claroc identified more than 6,800 exposed pages and, after opening a sample of a few hundred, found sensitive material including internal revenue reviews, loan applications, bank fraud alerts, job candidate prep notes, and staff vacation calendars. Claroc labeled these discoverable links "GhostShares." Meta paused the conversation-sharing feature roughly one day after Claroc published its findings. Claroc had reported the issue through Meta's bug bounty program on October 8 and said Meta did not respond to the firm's outreach. Meta CEO Mark Zuckerberg had described Muse as "built from the ground up for privacy and security." Claroc's CTO said the flaw appeared to be intentional design rather than a coding error.