Meta pauses Muse conversation sharing after public-link findings

Meta has paused Muse’s conversation-sharing feature while it reviews research that found more than 6,800 public share-page hostnames in a commercial passive-DNS dataset. Claroc said none of the 40 previously accessible shares it rechecked after the pause would open.

The pause marks a new mitigation step in the earlier Muse share-link exposure. Meta said it paused the feature while reviewing Claroc’s report and considering changes to how the links could be discovered. The company did not say when or whether sharing might return or describe any planned technical changes.

Claroc’s research says one query returned more than 6,800 Muse share hostnames after the firm removed wildcard-scan noise. According to Claroc, its researchers opened only a few hundred of those pages. Most were harmless, while a minority contained sensitive personal records or internal business documents.

That count refers to discoverable hostnames, not confirmed sensitive chats, affected users or misuse incidents.

Claroc said Muse generated public share pages with hostnames that combined a conversation title and a random identifier under cf.metaaiusercontent.com. Passive-DNS services record how hostnames resolve to network addresses; in this case, those historical records could expose both the title and identifier needed to locate a shared page.

Claroc said it reported the issue to Meta’s bug bounty program on October 8 and found no evidence that anyone had misused the shares it discovered. On October 20, the firm rechecked 40 links and said they no longer opened, although their hostnames and embedded titles remained in passive-DNS history. The sample does not establish whether every previously shared page became inaccessible.