Meta Turns Muse Sharing Back On After Researchers Flag Public Links
Shared Muse documents and images get new web addresses, and older links now ask viewers to request the new one from the sender
By AXY Tech Desk ·
Key points
- Meta has re-enabled sharing in Muse after security researchers reported that public links could be easy to find.
- The flaw involved web addresses for shared Muse artifacts, such as documents and images, which were named after conversation titles and written into public DNS. Chat sharing was not affected, according to Meta.
- Artifacts shared before the fix now have new URLs, and anyone who opens an old link will see a note asking them to get the new one from the sharer.
Meta has turned sharing back on in Muse, its product for conversations and the documents and images created inside them, after security researchers showed that some shared pages could be found by people who were never sent the link. David Singleton, a Meta executive, announced the change in a post on X. "The underlying issue is now fixed, and sharing is back on," he wrote.
The problem was not with chat sharing, according to Singleton. It involved the web addresses for shared Muse artifacts, which Meta describes as things like documents and images inside the product. Anyone who shared one of those items before the fix now has to send a new link. Anyone who opens the old address will be shown a note asking them to get the new one from the person who shared it.
For most people, the change is a small inconvenience. For some business users, it may mean re-sending work that has already gone to clients, colleagues or lenders, and checking whether anything sensitive was visible from the outside.
How the Web Addresses Were Built
Researchers at Claroc reported earlier this week that the web addresses for shared Muse conversations were named after the conversation’s title and written into public DNS. DNS, short for Domain Name System, is the part of the internet that translates a readable web name into the numerical address a computer uses to reach a site. It works like a public directory. Entries in it can be looked up by anyone who knows where to search.
That detail is the heart of the problem. A title is written in ordinary language, often by the person who created the document, and it usually describes what is inside. When that title becomes part of the address, the address itself gives away a clue. A person who knows roughly what a shared page is called may be able to find it without ever receiving the link.
The researchers’ report did not depend on hacking into anyone’s account. The exposure came from the way the addresses were constructed. Once that design choice was in place, any shared page with a revealing title could in principle be discovered by someone searching public records of web addresses.
Singleton’s post places the fault squarely in the URLs for shared artifacts. He did not describe the problem as a break-in, and he did not say how many pages were affected.
The Muse Pages Researchers Said They Found
The researchers said they were able to find Muse pages belonging to a marketing company and a small business owner. The marketing company’s page was an internal revenue review. The small business owner’s page was a loan application.
Those two examples show why the flaw matters. An internal revenue review can show how a company is performing, including figures it may never have published. A loan application usually contains personal and financial details about a person or a small firm, such as income, debts and identity information. Neither document was meant to be found by a stranger searching for a web address, and neither owner would have had much reason to expect that a title they typed could make the link discoverable.
The examples also show that the risk does not depend on technical skill. A business owner who sends a file to a client is trusting that the link will stay between the two of them. If the link can be reconstructed from the file’s name, that trust rests on something much weaker than it appears. Most people never think about how a web address is formed, yet it can reveal a great deal.
Meta’s Pause, the Fix and the New Links
Ars Technica said on Tuesday that Meta paused the sharing feature after it reached out about what was going on. The pause was the first visible step, and the company later moved to change the way artifact addresses work.
Singleton’s post set out what that change means for people who already shared work. He wrote: "If you shared an artifact before the fix: it now has a new URL." He added: "Anyone visiting the old link will see a note asking them to get the new one from you. We know that’s a pain, and we’re sorry for the disruption — but protecting user data has to come first."
The choice is a clear one. Meta could have kept old links working under their original addresses, which would have preserved convenience but left the exposed pattern in place. Instead, the company has moved the artifacts to new addresses and asked senders to pass them on. In plain terms, the old links are retired, and the people who hold them now need to ask for the new version.
The post also makes clear what the fix does not do. It can stop new pages from being found in the same way. It cannot reach back and erase copies of an address that someone already recorded or viewed before the change.
What Muse Users Should Do Now
If you shared Muse artifacts before the fix, the first step is to list the links you sent and send the new version to each person who needs it. A recipient who opens an old link will see a note rather than the document, so the page may look broken until you provide the replacement.
The second step is to look at what you shared. A title that describes the contents, such as a loan request or an internal financial review, is useful for organising your own work. It may also have been a visible clue to anyone who searched public records of addresses. If a document contains sensitive details, consider whether it should be sent again at all, or whether the recipient should get it through a more direct channel that does not rely on a shareable link.
The case offers a wider lesson for any service that creates shareable pages. Addresses that reveal titles or other details about what is inside can leak information even when the page is meant to be private. Treat a shared link as something that could one day be found, not as a permanent secret, and avoid putting sensitive detail in titles where the address might pick it up.
The Questions Still Open for Meta
The central question is whether the fix closes the gap completely. Singleton says the underlying issue is now fixed. The next test is whether researchers or other users find any shared pages that can still be reached through public searches of web addresses. If they do, that would show the repair is incomplete.
A second question is how much trust the episode costs. Pausing sharing and retiring old links shows the company accepted disruption to protect user data, and Singleton said so directly. Whether that satisfies businesses that use Muse for client and internal material will depend on how clearly Meta explains what was exposed, how many artifacts were affected, and how it will prevent a repeat.
For readers, the story is straightforward. A design choice in how Muse artifact addresses were built made some shared pages easy to find, and Meta has replaced those addresses. Anyone who shared a Muse document or image before the fix needs to send the new link, and any sensitive material shared under the old system deserves a second look.
Questions and answers
What went wrong with Muse sharing?
Researchers at Claroc reported that web addresses for shared Muse artifacts were named after conversation titles and written into public DNS. That made the pages easy to find, and the researchers said they located a marketing company's internal revenue review and a small business owner's loan application.
Does the Muse fix affect chat sharing?
According to Meta's David Singleton, the issue was with URLs for shared Muse artifacts, such as documents and images, and was not a flaw with chat sharing.
What should people do if they shared a Muse artifact before the fix?
Artifacts shared before the fix have new URLs. Anyone who opens an old link will see a note asking them to get the new link from the person who shared it, so senders need to pass on the new version.
Has Meta turned Muse sharing back on?
Yes. Singleton wrote on X that the underlying issue is now fixed and that sharing is back on. Ars Technica reported that Meta had paused the sharing feature after it was contacted about the problem.
Topics: Meta, Muse, Claroc, David Singleton, Data privacy, Shared links, DNS, Cybersecurity
Sources: The Verge