- Muse built share links with the conversation title as a readable phrase in the hostname plus a random identifier
- Opening a link resolves that hostname through DNS, so historical (passive DNS) records captured the full name
- One query was enough: researchers reconstructed and opened links without an account
- Exposed items included loan applications, bank transaction details, and an investor's internal performance report
- Most of the few hundred opened links were unremarkable; researchers found no evidence of misuse
- Claroc reported the issue through Meta's bug-bounty program on Oct 8
- Meta told Ars Technica it paused sharing while reviewing the report and considering discoverability changes
- Claroc's Oct 20 recheck found 40 previously accessible sample links no longer opened
- The old hostnames and title text remain in historical DNS records — suspending the feature can't erase those
Useful?