Muse fixes vulnerability where shared artifact links could be discovered via passive DNS
Muse fixed a design flaw in shared artifacts: the URLs of some shared artifacts could be discovered via passive DNS. The team immediately disabled the sharing feature and restored it after the fix. Artifacts shared before the fix have been assigned new URLs; visiting an old link prompts users to ask the sharer for a new link. Muse clarified that the issue only affects shared artifacts, not chat sharing. The Muse bug bounty program offers up to $300,000 for valid reports.
Why read this
AI score 54
The original text explains the cause of the vulnerability where shared links could be discovered via passive DNS, the fix, and how old links are handled after invalidation, helping readers understand the risk boundaries of this type of sharing feature.
Topics
Body
An update on @Muse shared artifacts.
Earlier this week, a security researcher published details of a design flaw in @Muse shared artifacts: some shared artifact URLs were discoverable via passive DNS. We disabled sharing immediately to prevent any unintended exposure, which is why shared artifacts were temporarily unavailable. Some articles we have seen in the press mentioned a flaw in chat sharing, and that is not the case - this issue was specifically about shared artifacts.
The underlying issue is now fixed, and sharing is back on.
If you shared an artifact before the fix: it now has a new URL. Anyone visiting the old link will see a note asking them to get the new one from you. We know that's a pain, and we're sorry for the disruption — but protecting user data has to come first.
We're grateful to the researchers who find and report issues like this. The Muse bug bounty program exists so these reports can reach us directly and responsibly, with awards of up to $300,000 for valid findings. Every report is reviewed. If you find something, please send it our way.