Meta Fixes Muse DNS Leak, Reassigns Links to Secure Exposed Business Data
Meta has re-enabled sharing for Muse AI artifacts after researchers found that public DNS records exposed sensitive business data via predictable links.
Key points
- Meta re-enabled sharing for Muse artifacts after fixing a flaw where public DNS records exposed conversation links.
- Security researchers at Claroc discovered thousands of links containing sensitive data such as loan applications and revenue reviews.
- The issue affected artifact URLs, not chat sharing, and Meta assigned new links to previously shared items to invalidate old exposures.
Meta has restored the sharing functionality for its Muse AI agent after addressing a security flaw that allowed public discovery of sensitive conversation links. The platform had paused this feature earlier this week following reports from security researchers at Claroc, who demonstrated that shared artifacts could be easily located via passive DNS searches. This exposure risked leaking private business documents and personal financial information to anyone who guessed or enumerated the URLs.
Root cause
The vulnerability stemmed from how Meta structured the web addresses for shared Muse artifacts, which include documents and images generated within the platform. According to Meta executive David Singleton, these URLs were derived from the conversation’s title and were subsequently written into public DNS records. This design choice made the links predictable and discoverable through standard DNS lookup techniques, rather than being obscured or randomised. Singleton clarified that the flaw was specific to artifact sharing and did not affect the privacy of standard chat interactions within the service.
View the original post on X
Attack path
Researchers at Claroc utilised a single passive DNS search to identify thousands of exposed Muse links. By querying public DNS data, they were able to locate active URLs that led to sensitive content without authentication. During their investigation, the team found examples including a marketing company’s internal revenue review and a small business owner’s loan application. This method required no direct interaction with Meta’s servers or user accounts, relying solely on the publicly available DNS infrastructure to map conversation titles to accessible web pages.
Affected versions
- Web-based Muse AI interface
- Shared artifact links generated prior to the fix
Mitigation
- Meta has assigned new, secure URLs to all artifacts shared before the fix.
- Users attempting to access old links are now redirected to a message requesting the new link from the original sharer.
- The sharing feature has been re-enabled following the resolution of the DNS exposure issue.
What it means for organisations
Teams should verify whether employees have shared sensitive internal documents via AI platforms that support public linking. Organisations need to establish clear policies on what data can be exported from generative AI tools. Security leaders must inform staff that previous shares may have been exposed and require them to regenerate links for any ongoing collaborations. Departments handling financial or strategic data should audit their use of external AI services to ensure that default sharing settings do not inadvertently publish confidential information to the public internet.
Background: AI agents
AI agents matter for security because they move beyond generating text to executing code and accessing systems. This autonomy means a single compromised prompt can trigger cascading failures across your infrastructure, requiring new controls for intent verification and action boundaries rather than just content filtering.
Read the full guide: Why AI Agents Matter for Security: Autonomy Risks
What to do and how to stay safe: Meta
- Review internal policies to prohibit sharing sensitive business data via public AI artifact links.
- Audit recent exports from AI tools to identify any documents that may have been exposed via predictable URLs.
- Monitor passive DNS records for your domain to detect any unexpected or unauthorised link registrations.
- Educate staff on the risks of using public sharing features for confidential materials until vendor controls are verified.
General security guidance from the TechSec Observer newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Was the entire Muse chat history exposed?
No, Meta stated the issue was limited to shared artifacts like documents and images, not standard chat sharing.
How can I access my previously shared artifacts?
You must request new links from the original sharer, as old URLs are now invalidated and redirect to a notice.
Did Meta patch the chat sharing feature?
Meta confirmed the fix addressed artifact URLs specifically; chat sharing was not identified as flawed in this incident.
