One DNS Lookup Exposed 6,800 Private Meta Muse Chats
By Daniel Rao, TechPulse USA File photo: Meta's headquarters in Menlo Park, California. The company paused Muse's chat-sharing feature on October 20, 2026. Photo: InvadingInvader / Wikimedia Commons (freely licensed). It took one query. Not a breach, not a hack, not a leaked database — a single passive-DNS lookup, the kind any security researcher can run from a browser tab, and 6,800 of Meta's Muse chat shares spilled out into the open, listed by name like a table of contents. Nobody broke into anything. Meta had simply published the keys and left them where the internet keeps its phone book. Two days after the research went public, the feature was dead. Meta paused link sharing across Muse on October 20 — but only after Ars Technica picked up the phone and asked what, exactly, the company planned to do about it. Twelve days earlier, the researchers had told Meta's own bug-bounty programme. They say they never got a reply. That is the part that should bother yo...