Meta re-enabled Muse sharing after resolving an architectural flaw where conversation URLs derived from conversation titles were exposed through public DNS records.
Technical Architecture & Context
Meta temporarily disabled its Muse conversation sharing feature following disclosures by security researchers who identified a predictable URI generation vulnerability. The platform previously constructed shared web addresses directly from conversation titles, writing these routes into public DNS records. This design pattern inadvertently exposed internal revenue reviews and sensitive loan applications to external discovery through enumeration and DNS log analysis.
Systems Implications
This incident highlights critical security anti-patterns in URL routing and identifier generation for cloud applications. Relying on human-readable or predictable strings for public resource sharing violates core principles of cryptographic randomness and access control. Restoring the service required modifying the underlying token generation architecture to implement high-entropy, unguessable identifiers alongside robust authorization checks.
Primary Source & Reference
Original reporting and technical documentation: Meta turns Muse sharing back on via The Verge (AI & Tech).