Meta’s Muse AI Leaked Bank Alerts and Loan Apps via DNS

Bank fraud alerts, small-business loan applications, and internal corporate calendars were exposed to anyone running a basic internet search after Meta launched its Muse agentic AI platform last month. The leak did not require sophisticated hacking tools. It relied on standard public records.

Security firm Claroc discovered that the sharing mechanism for Muse conversations routed URLs through predictable subdomains tied directly to conversation titles. Because these web addresses resolved through public passive DNS records—essentially the internet’s phone book mapping domains to IP addresses—the links became indexed and searchable by default.

Claroc researchers pulled 6,800 shared conversation links using this method, according to a blog post published by the firm. Ars Technica first reported on the findings.

The exposed data highlights how quickly enterprise users adopted the tool for sensitive workflows. Among the documents accessible without authentication were meeting schedules with a frontier AI lab, partial bank account details tied to a fraud alert, and internal company vacation calendars, Claroc said.

This type of vulnerability falls under insecure direct object references, a flaw where an application exposes internal objects like files or database keys without proper access control. Predictable URL structures have historically caused similar breaches across major technology platforms when sharing features are rolled out before security architecture catches up.

Meta disabled the sharing functionality following the disclosure. “We’ve paused this functionality while we review this report and consider changes to how these links can be discovered,” the company told Ars Technica in a statement.

Claroc confirmed its researchers could no longer open a sampling of the previously accessible links after Meta pushed the update.