Meta wrote your conversation title into the URL. One DNS query found 6,800 Muse shares.

Meta has paused link-sharing in Muse, its general-purpose AI agent, after a security firm showed that anyone with a passive-DNS account can find the pages behind those links. Claroc enumerated 6,800 Muse share pages on cf.metaaiusercontent.com and opened a few hundred of them. Among the results, Ars Technica reported this week, were a small-business owner's loan application with the amount requested, a national marketing company's revenue review marked for its CEO, a to-do list carrying a bank fraud alert and a partial account number, and a real-estate investor's report with two property addresses and exact mortgage figures.

The token was never the weak part

Share links normally rest on one defence: a long string nobody can guess. Muse kept that string, and also put the conversation's own title in front of it — in the subdomain, not the path — home-sale-budget-9f21c8a3.cf.metaaiusercontent.com, q3-revenue-review-7b1e42f0.cf.metaaiusercontent.com, loan-application-draft-a4c9e2.cf.metaaiusercontent.com. That is a naming decision, not a cryptographic failure, and it was enough. DNS has no notion of a quiet lookup: every hostname resolution is observed and resold in commercial datasets. The moment the intended recipient clicked, the subject of the document became a searchable string.

"If you had asked us beforehand, we would have guessed that gathering these would take real effort," Claroc's researchers wrote. "It took one query."

Twelve days of silence, then a reporter

Claroc CTO Asaf Aprozper said he reported it through Meta's bug bounty programme on 8 October and tried LinkedIn, with no reply either way. Meta answered Ars. "We opened the Muse bug bounty program so researchers could raise different scenarios and help us continue improving the product," the company said. "People have the ability to share specific Muse artifacts, which creates a page that can be accessed by those with the link. However, we've paused this functionality while we review this report and consider changes to how these links can be discovered."

Paused is not fixed

Claroc rechecked 40 shares on 20 October: none opened, and the hostnames returned errors. The records naming them are still in passive-DNS history, which is a log of what was resolved, not an index of what Meta serves. The same exposure was already mirrored on urlscan.io, where Claroc counted more than 75 saved scans of Muse share pages. Meta's robots.txt keeps search crawlers off the share paths, but robots governs crawling, not access.

Zuckerberg said last month that Muse was "built from the ground up for privacy and security." The pause lands as Meta pushes Muse Spark Open, an 816-billion-parameter model it calls the most capable US open-weight release to date. An assistant that needs most of a user's accounts is asking for a specific kind of trust. This week it got a reminder that a hostname is a public document.