Meta told Ars Technica on October 20 that it had paused Muse’s sharing feature while reviewing Claroc’s report. Claroc reported more than 6,800 Muse share hostnames in one commercial passive-DNS dataset, but that count is not a tally of confirmed sensitive conversations.
What Claroc’s 6,800-plus count covers
A hostname is the name that identifies a web host. Passive DNS is a historical record of hostnames observed during DNS lookups. Claroc searched one commercial passive-DNS dataset for Muse share hostnames under cf.metaaiusercontent.com and filtered out noise from wildcard DNS scans. It counted more than 6,800 hostnames and opened only a few hundred associated pages.
Claroc said most of the pages it examined were ordinary; a minority contained sensitive personal records or internal business material. The figure counts hostnames, not confirmed sensitive conversations or affected people.
Why Muse share hostnames were discoverable
Claroc reported that the hostnames included a readable conversation title and a random identifier. Because passive-DNS records can retain a hostname after a browser resolves it, those records could make a shared page discoverable through its title. Claroc said the pages it inspected opened without an account, and that its researchers found hostnames in the dataset rather than guessing or brute-forcing them.
What Claroc reported finding
Examples included executive-search preparation, a company revenue review, a small-business loan application, a bank-fraud-related to-do item, a real-estate report and a staff vacation calendar. These were examples from the few hundred pages Claroc opened, not a count of all shared conversations.
What the October 20 recheck found
Claroc said it submitted its findings to Meta’s bug-bounty program on October 8. On October 20, it rechecked 40 shares that had previously opened. None opened in that check, and their content hostnames returned errors. The hostnames and titles remained in passive-DNS history.
On October 20, Meta told Ars Technica it had paused Muse sharing while it reviewed Claroc’s report and considered changes to how the links could be discovered.
