Meta’s Muse share links leaked chat titles into public DNS, and researchers found 6,800 of them

Meta has paused the feature that lets people share Muse conversations by link after security firm Claroc reported finding more than 6,800 of those links in public DNS records. Claroc says it could open hundreds of shared conversations, including a marketing company’s revenue review, a small business owner’s loan application, a workplace’s full-year staff calendar and a job candidate’s notes for a call with an AI lab. Muse spokesperson Tracy Clayton told The Verge that Meta paused the function while it reviews the report and considers how the links can be discovered. Ars Technica first reported the exposure.

According to Claroc, Muse built each shared page’s web address from the conversation title followed by a random ID. The hostname often revealed what a page contained before anyone opened it, and because the link carried the same title and ID, pulling the hostname from DNS was enough to rebuild it. Public DNS records work as a directory of hostnames, and services that create a unique hostname for each piece of shared content can list them there without meaning to.

A random ID is supposed to make a link unguessable. Putting it somewhere that gets recorded publicly undoes that. Sharing a useful chat with a colleague is a reasonable feature; the failure is treating a share link as private while publishing the clues to find it. A company deploying an assistant to a huge user base should catch that in design review, not after outside researchers do.

The Verge notes that ChatGPT, Claude and Grok conversations have each ended up in Google Search at various points. The industry keeps relearning the lesson: people put business plans, finances and personal lives into these chats, so every sharing pathway should be designed as if the content were sensitive, because it usually is.

For Muse, this adds to earlier trouble, including a Mac zero-day that let local apps hijack the agent (our coverage) and criticism that it nudges users toward sharing more data (review). Meta says Muse now has over 10 million users, with shopping a top activity (coverage), so the exposure surface is large. Trust in an assistant that does work for people rests on dull defaults: links that stay unguessable, clear warnings about what becomes visible and easy revocation.

As assistants handle more real work, chat leaks stop being embarrassing and become material, with financial data, hiring information and internal schedules involved. That raises the bar for every lab shipping share features. The key question for Meta is whether its fix covers links already exposed, not just future ones. Meta’s newer Spaces collaboration feature for Muse makes the same design questions more pressing (Spaces coverage). More in our Meta coverage and cybersecurity coverage.