Meta's Muse AI assistant exposed thousands of users' shared conversations due to a critical design flaw. Conversation titles were placed in subdomains, making them discoverable through public DNS records. Security researchers from Claroc were able to enumerate 6,800 such links with relative ease. The exposed information was clearly not intended for public access, despite Meta CEO Mark Zuckerberg's previous assurances about Muse's privacy and security. The shared links, typically designed with long, unguessable text sequences, failed to provide adequate security in this instance. The vulnerability stemmed from Muse's decision to include the conversation name directly in the subdomain rather than in the URL path. This allowed researchers to use passive DNS searches to uncover the URLs. Passive DNS records store historical domain name resolutions, and these systems record DNS information when a share link is clicked. Claroc researchers exploited the consistent domain name cf.metaaiusercontent.com and the appended conversation titles to discover the links. Meta has since suspended the sharing feature to address these security concerns.