Meta Muse leak exposed 6800 private chats via passive DNS, researchers say
AGI Hunt · wechat · 2026-10-20
Meta Muse, launched in September with Zuckerberg claiming it was "built from the ground up for privacy and safety," leaked over 6,800 shared private conversations, per security firm Claroc.
- How it worked: Muse generates a unique subdomain (title + random ID) per shared chat. Any visit triggers DNS resolution, which passive DNS providers log. Searching a commercial passive DNS database for the shared domain surfaced 6,800+ hostnames, each viewable without login.
- What leaked: mostly small-business sites and calendars, but dozens of sensitive items — exec job interview prep with a frontier AI lab including internal contacts and meeting times, a company revenue review for its CEO, loan applications, property addresses and mortgage figures, a 50-person vacation schedule.
- Response: reported via Meta's bug bounty on Oct 8; Meta only paused the feature after ArsTechnica inquired. The titled subdomains remain in passive DNS history.
Related event: Meta Muse leaks over 6,800 private conversations(2 posts)→
More from Safety
- Cloudflare ships new WAF with full transaction detection, free by default to block php2shell — irvinebroque · 2026-10-22
- Wiblin's plea to AI lab staff: reassess now whether your work delays or accelerates RSI — geoffreyirving · 2026-10-22
- Reddit essay pushes back on doom: recursive safety improvement could solve AI risk — yfreon · 2026-10-22
- Computer security overhang: infinite free tokens will surface 100,000s of vulns — Afinetheorem · 2026-10-22
- tenobrus: even frontier labs with unlimited budgets can't secure their systems against their own models — AaronBergman18 · 2026-10-22
- eMudhra blames key ceremony flaw for weak root keys, reportedly cracked with AI tooling — basedjensen · 2026-10-22