Meta paused its Muse AI conversation-sharing feature after security researchers reported that shared-page addresses could be discovered through public DNS records.
What the research found
Claroc said it located more than 6,800 share hostnames and inspected a sample. Some shared pages contained personal or business material. The firm said it had no evidence of misuse.
Why it matters
Users who share conversations may expect only recipients to see them. But a publicly accessible page can become discoverable through services other than search engines.
What the number means
The 6,800 figure refers to addresses identified by the researchers, not a verified count of people harmed. Claroc inspected only a sample and said it found no evidence of misuse. Its report withheld identifying details from affected conversations.
What changed?
Meta said it paused the feature while reviewing the report. Claroc’s October 20 update said previously accessible sample pages no longer opened.
How were the addresses found?
Claroc says Muse share-page hostnames included conversation titles. Because domain lookups can appear in passive-DNS datasets, someone could discover a full address without receiving it from the original user.
How to reduce risk
Avoid sharing chats containing passwords, financial records or confidential documents. Review existing links and revoke exposed credentials where necessary.
Sources: Claroc research and Ars Technica.
