Meta's general-purpose AI agent Muse, which CEO Mark Zuckerberg publicly described as "built from the ground up for privacy and security," has been leaking users' confidential information through a basic architectural flaw in its URL-sharing feature. Security researchers at Claroc discovered that share links — meant to be protected by long, unguessable URL strings — could be trivially enumerated using passive DNS lookups, a standard commercial service available to anyone. The mechanism is straightforward. When a Muse user shares a conversation and the recipient clicks the link, the DNS resolution is recorded by passive DNS monitoring systems. Those records are then searchable through commercial databases. One query returned 6,800 discoverable share links. The researchers opened a few hundred and found loan applications, executive-search call notes naming internal contacts, revenue reviews marked for CEOs, staff vacation calendars, bank fraud alerts with partial account numbers, and real-estate investment performance reports with exact figures. The vulnerability is not a software bug in the traditional sense. It is a design decision. Muse's share links rely on "security through obscurity" — the assumption that a long random URL cannot be guessed. That assumption holds against brute-force guessing but collapses entirely against passive DNS enumeration, which simply records and indexes every URL that gets resolved. This is a well-known limitation, and building a sharing system that depends entirely on URL unguessability without additional access controls is a freshman-level architectural choice for a company of Meta's scale. Meta's response has been to suspend the sharing feature while it reviews the report. The company framed the discovery through its bug bounty program, though researcher Asaf Aprozper, Claroc's co-founder and CTO, reported the findings on October 8 and received no reply through either the bounty program or direct LinkedIn outreach before the story went public. Meta's statement emphasized that users had "the ability to share specific Muse artifacts" — a framing that subtly shifts responsibility toward users for choosing to share, rather than toward Meta for making shared content discoverable. The gap between marketing and engineering here is the real story. Zuckerberg's "built from the ground up for privacy and security" claim is directly falsified by a sharing architecture that any competent security engineer would flag during design review. Passive DNS enumeration is not an exotic attack vector. It is a standard reconnaissance technique taught in introductory security courses. The fact that it was not accounted for suggests either a rushed launch where security review was incomplete, or a team that genuinely did not consider this threat model. The exposed data reveals how users actually interact with AI agents — not as toy demos but as working tools handling real business intelligence. Loan applications, revenue figures, HR calendars, and executive hiring pipelines are exactly the kind of sensitive material that organizations worry about when employees adopt AI tools. This incident will strengthen the hand of enterprise IT departments arguing for restricting AI agent use, and it gives every competitor a concrete example to cite when pitching against Meta's AI products. Meta now faces a choice: bolt on proper access controls (authentication, expiring tokens, consent flows) and re-enable sharing, or accept that the feature's trust model was fundamentally broken. The broader lesson is that AI agents are not chatbots — they process and store material with real-world consequences, and their infrastructure must be held to the same standard as any enterprise SaaS product handling confidential data.
