The Pulse
Meta Restores Muse Sharing After Replacing Artifact Links
Meta has restored sharing in its Muse AI assistant after Claroc researchers found more than 6,800 share hostnames through passive DNS. The company says previously shared artifacts now have new URLs, while old links direct visitors back to t
AI.info Team · Written with AI · fact-checked ·
More than 6,800 Muse share hostnames turned up in one passive-DNS search by security firm Claroc. On October 22, Meta restored Muse sharing after temporarily disabling the feature, saying it had fixed the underlying issue and replaced URLs for artifacts shared before the change.
Meta’s David Singleton said in a post on X, quoted by The Verge, “The underlying issue is now fixed, and sharing is back on.” Users who open an old artifact link now see a notice asking them to request a replacement from the person who shared it. Meta apologized for the disruption, saying protection of user data had to come first.
What Claroc found in Muse links
Claroc’s October 18 report described Muse shares as pages that anyone with a link could open. The researchers found that share hostnames included the conversation title and were recorded in public DNS, where a passive-DNS search could surface them without the searcher first receiving a link. Claroc said its filtered search returned more than 6,800 hostnames; its team opened only a few hundred.
Most of the pages the researchers opened were unremarkable, Claroc said, but some contained sensitive personal or business material. Examples included a small-business loan application, an internal revenue review marked for a company chief executive, and a calendar listing employees’ vacation weeks. Claroc said it had no evidence that anyone misused the shares and could not establish whether others had accessed them.
Meta draws a line between artifacts and chats
Meta describes the issue as involving links to shared “artifacts,” rather than a flaw in chat sharing. Its Muse help page defines artifacts as items such as documents, images, code and web apps. Claroc’s report, by contrast, discusses shared conversations and says the links it examined could lead to pages containing conversation material.
The distinction matters because the two descriptions frame what Meta says it fixed differently from what Claroc says its researchers found. The company’s public explanation, as quoted by The Verge, identifies artifact URLs as the problem; it does not provide technical details about how the replacement addresses are generated. The available accounts therefore establish that Meta changed the links, but do not describe the URL design behind the fix.
Replacement links do not erase DNS records
Meta’s change means people who shared an artifact before the fix must send its new URL to anyone who still needs access. It does not remove the old hostnames from historical passive-DNS records: Claroc said those records, including the titles embedded in the hostnames, remained after the earlier pause in sharing. The researchers also cautioned that their search covered one discovery channel and a short period, not the total number of shares or the length of time each page was accessible.
Meta paused sharing on October 20 after Ars Technica asked the company about Claroc’s findings. Claroc said it had submitted its report to Meta’s bug bounty program on October 8. The old hostnames remain in DNS history, while the status of any access before the fix is still unknown.