Meta’s AI URL Flaw Leaked CEO Docs to Public DNS Records

Corporate revenue reviews, small-business loan applications, and executive-search preparation notes sat exposed in public internet records for days after Meta Platforms Inc. failed to secure how its Muse AI assistant generated shareable links. The vulnerability bypassed login requirements entirely.

Security researchers at Claroc discovered more than 6,800 conversation hostnames logged in commercial passive DNS datasets, according to the firm’s findings. The exposure stemmed from a structural flaw in how Muse formatted web addresses for shared content, placing descriptive conversation titles directly inside hostnames alongside random identifiers.

When a browser opened one of these shared pages, it triggered a standard DNS lookup to resolve the hostname. Passive DNS services routinely observe and archive these lookups. Because Muse embedded the conversation’s subject matter into the hostname itself, those external archives effectively became a searchable index of what users were discussing with the AI. Anyone querying the dataset for Meta’s content domain, cf.metaaiusercontent.com, could reconstruct the full URLs without guessing or brute-forcing the random strings.

Standard industry practice for link-sharing tools relies on long, unpredictable strings buried in the URL path rather than the hostname to prevent outsiders from discovering private pages. Claroc noted that Muse’s random identifiers were technically long enough to resist guessing. The architecture defeated its own security by broadcasting the exact location of the files through the domain name system.

Inspecting a sample of a few hundred reconstructed pages, Claroc found documents that appeared intended for restricted audiences. One was a marketing company’s revenue review marked specifically for its CEO. Another contained a real estate investor’s report listing property addresses, mortgage amounts, income figures, and returns. Researchers also located preparation notes for a confidential executive-search call with an AI lab, which named an internal contact and specified the meeting time, according to Claroc.

Accessing the material required no authentication. While Muse loaded conversations via JavaScript—meaning a basic page request returned little visible content—opening a reconstructed link in any ordinary browser displayed the full exchange. Claroc confirmed this worked even in logged-out incognito sessions.

Meta attempted to restrict visibility using a robots.txt file instructing search engines and AI crawlers to avoid the share paths. Those instructions do not govern DNS infrastructure. Passive DNS services record network traffic regardless of crawler directives, rendering the restriction ineffective against the specific mechanism Claroc used to find the data.

“People have the ability to share specific Muse artifacts, which creates a page that can be accessed by those with the link,” Muse spokesperson Tracy Clayton said in a statement to The Verge. “However, we’ve paused this functionality while we review this report and consider changes to how these links can be discovered.”

Claroc reported the issue to Meta’s bug bounty program on October 8. Meta announced the suspension of the sharing feature twelve days later. When researchers retested 40 previously accessible shares on October 20, none loaded, and their content hostnames returned errors.

The total of more than 6,800 represents discovered hostnames rather than a confirmed count of sensitive corporate leaks. Claroc stated it found no evidence of active misuse by third parties and did not contact the individuals or companies whose data appeared in the sample. The firm also could not establish whether anyone else had independently discovered the reconstruction method before their disclosure.

Suspending the pages stopped new access during Claroc’s October 20 tests. It did not purge the descriptive conversation titles already permanently captured in external passive DNS history archives.