Rank #27 of 36·Security·20 Oct 2026·Meta Muse (personal AI agent)
Meta's Muse agent wrote chat titles into public web addresses, and 6,800+ shared chats turned up in one search
“The random ID was unguessable. Shame DNS wrote it down the first time anyone clicked.”
- Each share's address was the chat title plus a random ID
- Passive DNS logged the full hostname the first time anyone opened it
- Pages opened with no login; Meta has paused sharing
Mark Zuckerberg said Meta's Muse agent was "built from the ground up for privacy and security." Then a security firm found thousands of its users' shared chats with a single search.
What happened
When you ask Muse to share a conversation, it publishes a page anyone with the link can open. Claroc found Muse built each link's web address from the chat's own title plus a random ID, as a hostname like home-sale-budget-9f21c8a3. The first time anyone opened a share, passive-DNS services logged that full hostname, random ID included. One query for Muse's content domain returned more than 6,800 shares, listed by name.
The damage
Claroc opened a few hundred, with no account. Most were harmless. A minority held a small-business loan application, a CEO-only revenue review, a to-do list with a bank fraud alert and part of an account number, a staff holiday calendar, and a job candidate's notes for a confidential call with a frontier AI lab. Claroc says it has no evidence anyone misused the pages, but can't tell how long they were reachable or who found them first.
How it was caught, and what happened next
Claroc reported it to Meta's bug bounty on 8 October. After reporters asked, Meta paused Muse sharing on 20 October 'while we review this report and consider changes to how these links can be discovered.' On a recheck, 40 earlier shares no longer opened, but the titles are still in DNS history.
A hostname is never a secret. If the link is the lock, keep it out of DNS.
