Meta restores Muse sharing with new URLs after security report
Meta has re-enabled sharing in Muse and has given new URLs to shared Muse "artifacts". The change follows a report from security researchers that public links to shared content could be easy to find.
Researchers at Claroc reported earlier this week that the web addresses for shared conversations from Muse were named after a conversation's title and written into public DNS. The researchers said they had been able to find Muse pages such as a marketing company's internal revenue review and a small business owner's loan application. Ars Technica said on Tuesday that Meta paused the sharing feature after it reached out about what was going on.
In a post today on X, Meta's David Singleton said: "The underlying issue is now fixed, and sharing is back on." According to Singleton, the problem lay with the URLs for shared Muse artifacts, which Meta says are things like documents and images inside Muse. He said it was not a flaw with chat sharing.
The fix has a cost for users who already shared something. Singleton said an artifact shared before the fix now has a new URL, and anyone who visits the old link will see a note asking them to get the new one from the person who shared it. He acknowledged the inconvenience, saying Meta knows it is a pain and is sorry for the disruption, but that protecting user data has to come first.
Key facts
- Meta turned Muse sharing back on after pausing it; Ars Technica said the pause followed its contact with Meta about the problem.
- Claroc researchers reported that web addresses for shared Muse conversations were named after a conversation's title and written into public DNS.
- The researchers said they found Muse pages including a marketing company's internal revenue review and a small business owner's loan application.
- Meta's David Singleton said the issue was with URLs for shared artifacts (documents and images inside Muse), not chat sharing.
- Artifacts shared before the fix now have new URLs; old links show a note asking visitors to get the new link from the sharer.
Why it matters
Shared links are meant to reach only the people they are sent to. The Claroc researchers reported that Muse addresses were named after a conversation's title and written into public DNS, and said they were able to find Muse pages such as an internal revenue review and a loan application. Meta responded by pausing sharing, then restoring it with new URLs for shared artifacts.
Who it affects
Anyone who shared a Muse artifact, meaning a document or image inside Muse, before the fix. Those artifacts now have new URLs, and people who open the old link see a note telling them to ask the sharer for the new one. Singleton said the problem was not a flaw with chat sharing.
How to use it
Sharing in Muse is available again. If you shared an artifact before the fix, expect that the old link no longer works for recipients and send them the new URL. Singleton's wording: "If you shared an artifact before the fix: it now has a new URL."
How solid is it
The core account comes from The Verge, relaying the Claroc researchers' report and Singleton's post on X. The claim that Meta paused sharing is attributed to Ars Technica. The statement that the issue is fixed is Meta's own; the source does not say what the technical fix consisted of beyond issuing new URLs. No absolute calendar dates are given for the report, the pause or the fix.
Risks and caveats
The source does not say how many users or shared artifacts were affected, and it does not say whether any data was accessed or misused by anyone other than the researchers. It also does not say when sharing was paused or how long it stayed off. Singleton's account locates the problem in artifact URLs rather than chat sharing; the Claroc description refers to shared conversations from Muse.
“The underlying issue is now fixed, and sharing is back on.”
— David Singleton, Meta, in a post on X