Meta Patches Muse AI Leak That Exposed Chat Links via DNS
Security researchers discovered that Meta's Muse AI chat sharing feature leaked thousands of private links containing sensitive personal and corporate data, prompting Meta to temporarily suspend the feature. This flaw highlights how poor URL design and subdomain naming can inadvertently expose confidential user data through public infrastructure logs, posing significant privacy risks. Researchers found that Meta Muse generated web addresses based on chat titles and embedded them in subdomains under cf.metaaiusercontent.com, which were then logged by passive DNS databases.
## BACKGROUND
Passive DNS is a method of collecting and storing historical DNS query and response data to analyze network traffic and map domain name relationships over time. Meta Muse is a personal AI agent designed to help users manage tasks and communications.