Claroc says Meta Muse share-page addresses contain conversation titles, and passive DNS can find more than 6800 share pages

Claroc's research states that Meta's AI agent Muse names the web addresses of shared conversations after the conversation titles, and a single commercial passive DNS query yielded more than 6800 shared-page hostnames. Muse's share pages open with just a link, no login required; robots.txt only constrains crawlers and does not restrict access, and when a browser resolves a hostname it records the full address, including the random ID within it, into a queryable public DNS index. Claroc opened only a few hundred pages, a small number of which contained sensitive content, including a candidate's confidential interview preparation for a frontier AI lab (including that lab's internal contacts and meeting times), company revenue assessments, loan applications, and employee vacation calendars; the companies involved were confirmed as real through public information. Claroc reported the matter through Meta's bug bounty program on October 8, 2026, and stated it found no evidence that these shares were misused; its conclusions cover only one discovery channel, one product, and a relatively short time window, and do not represent the overall scale of Muse's exposure.