Meta suspends Muse AI sharing feature following data exposure
Security researchers identified over 6,800 publicly accessible AI conversation logs that were exposed via passive DNS records.
Meta has suspended the sharing functionality of its Muse AI assistant following a security report from the research team Claroc. The investigation revealed that more than 6,800 conversation logs were discoverable through passive DNS queries, allowing unauthorized access to sensitive personal and corporate data.
The vulnerability stemmed from how Muse generated URLs for shared conversations. By incorporating conversation titles into the subdomain structure, these links were recorded by DNS services, effectively indexing private interactions in historical databases. Researchers confirmed the presence of sensitive content including loan applications, internal business documents, and private scheduling materials.
Following the discovery, reported via Meta's bug bounty program, the company disabled the affected pages. While the links are no longer functional, the underlying hostnames remain in historical DNS logs. Meta stated it is currently investigating the issue and evaluating modifications to ensure that shared content cannot be discovered through such indexing mechanisms.