Meta's New AI Agent Muse Leaked Private Chats Through Predictable Share Links

Meta billed Muse, its new general-purpose AI agent, as a product built "from the ground up for privacy and security." Researchers just found a way to read other people's private conversations with it using nothing but a passive DNS lookup.

Security firm Claroc reported Monday that it was able to enumerate roughly 6,800 links Muse users had generated to share conversations, images, and searches with others. After opening a few hundred of them, researchers turned up a trove of material that was clearly never meant to leave the original conversation: a job candidate's prep notes for a confidential call with a frontier AI lab, complete with the lab's internal contact and meeting time; a marketing company's internal revenue review flagged for its CEO; a small-business owner's loan application and the amount requested; a to-do list referencing a bank fraud alert with a partial account number, transaction amount, and time; a real-estate investor's performance report with property addresses and exact income, return, and mortgage figures; and a full staff vacation calendar listing dozens of employees by name against the weeks they'd be out of office.

"If you had asked us beforehand, we would have guessed that gathering these would take real effort," the researchers wrote. "It took one query."

How a sharing feature became a leak

Like most services that let users generate a link to show someone else their content, Muse is supposed to protect that content with obscurity: the shared URL contains a long, effectively unguessable string of characters, so only someone who already has the link can open it. That's standard practice across the industry, and on its face, Muse appears to follow it.

The problem is what else Meta put in the URL. Every Muse share link lives under the domain cf.metaaiusercontent.com, and alongside the random string, the link also includes the name of the conversation itself. So a budget discussion might generate something like home-sale-budget-9f21c8a3.cf.metaaiusercontent.com, while a company's quarterly numbers might show up as q3-revenue-review-7b1e42f0.cf.metaaiusercontent.com. A loan application draft might read loan-application-draft-a4c9e2.cf.metaaiusercontent.com.

Embedding the topic in the URL doesn't just make links easier for the recipient to recognize at a glance. It makes them trivially discoverable by anyone who knows where to look, because of how the internet's addressing system quietly keeps records.

That record-keeping is called passive DNS. Every time a device looks up a domain name, like cf.metaaiusercontent.com, to find the server behind it, that lookup generates a DNS response. Various sensors across the internet's infrastructure, sitting near recursive resolvers and other chokepoints, capture those responses and feed them into searchable databases that commercial services sell access to. It's a well-established tool used for security research and threat intelligence. In this case, the moment a Muse user's recipient clicked a share link, the lookup for that specific subdomain, conversation name and all, got logged into one of these passive DNS systems. From there, anyone running a search against the metaaiusercontent.com domain could pull back the full list of subdomains ever queried, names included.

That's exactly what Claroc did. No hacking, no exploit, no credential theft. Just a search against a commercial passive DNS database, filtered to one domain Meta controls.

Obscurity alone isn't protection

The underlying flaw isn't the use of unguessable strings in share links; that part is fine. It's the decision to pair that string with a human-readable label describing what's inside, then route it all through a domain structure that gets logged by infrastructure outside anyone's control. The random portion of the URL keeps a casual visitor from guessing the link. It does nothing to stop someone from harvesting the list of links that already exist and have already been visited.

For a product Meta has positioned as privacy-first, the gap is notable less for its technical complexity and more for how basic the exposure path turned out to be. A researcher didn't need to breach Meta's servers or intercept traffic. They needed a passive DNS subscription, which is the kind of tool security teams and marketers alike can buy off the shelf, and the patience to open a few hundred links.

Meta hasn't offered details in this reporting about a fix, and it's unclear how long the naming scheme has been in place or how many links beyond the 6,800 researchers found might exist. What's clear is that the content exposed wasn't hypothetical. Hiring plans, bank fraud alerts, loan amounts, and real estate returns are the kind of details people share with an AI assistant precisely because they expect it to stay private. The question now is how quickly Meta changes the way Muse builds its links, and how many of those 6,800 conversations were already seen by someone other than their intended recipient before anyone noticed.