Meta paused Muse’s conversation-sharing feature after security firm Claroc found it could locate 6,800 links that users had created to share chats, according to Dan Goodin at Ars Technica. Muse put each conversation’s title in the link’s subdomain, so once a recipient opened it, the address landed in passive DNS databases that anyone can search. In the few hundred links Claroc opened, it found a small-business loan application, a company revenue review prepared for its CEO, a bank fraud alert showing part of an account number, and an office’s full staff vacation calendar. Claroc said it flagged the problem to Meta’s bug bounty program on October 8 without getting a reply, and Meta announced the pause only after Ars asked about the findings.
