Claroc enumerates 6,800 Meta Muse share URLs exposing 6800+ private artifacts

Meta launched Muse with a share feature that generated predictable URLs. Claroc researchers performed passive DNS lookups on the domain, retrieved the full set of resolved links, and opened several hundred. Contents included a candidate’s notes naming a frontier lab contact and meeting time, a marketing firm’s CEO-marked revenue review, a small-business loan file with amount and partial account data, plus a staff vacation calendar listing dozens of employees. Meta suspended the feature on October 8 after the report and stated it would review link discoverability while the bug bounty remained open. Passive DNS records captured the links once recipients clicked them, eliminating any need for brute-force guessing or active scanning. The design reused the same subdomain and short random string pattern across all shares, turning a standard privacy control into an indexable dataset. Operationally this means any user who clicked a shared Muse artifact created a permanent, publicly searchable record of sensitive content without additional consent or rate limits. Meta’s earlier claim that Muse was “built from the ground up for privacy and security” is directly contradicted by the enumerated artifacts. The incident follows the same pattern seen in prior Meta sharing endpoints where URL construction lacked sufficient entropy. Future share mechanisms will require per-link access tokens or mandatory expiration to prevent passive enumeration.