Meta's AI Chat Links Leaked Through DNS

00:00:02 — Maya
Welcome to Development Radio. I'm Maya, here with Alex. Today's story starts with something we all do without thinking: you click share, you copy the link, you send it. Alex, when a page says anyone with the link can view, do you believe it?

00:00:18 — Alex
I believe it the way I believe this will only take five minutes. Technically possible. Emotionally, I have questions.

00:00:26 — Maya
That's fair. I send those links all the time. Usually to one person. Sometimes to a group chat, which is basically publishing.

00:00:35 — Alex
A group chat is a press release with emoji. But the link itself feels private, right? It's long, it's random, nobody could guess it.

00:00:43 — Maya
Exactly. It feels like a key. If you don't have the key, you don't get in. And somewhere there's a document called do not forward that its own author forwarded.

00:00:54 — Alex
That title is doing a lot of work. Okay. Today's story is about shared links that leaked without anybody forwarding them. Nobody guessed them, nobody hacked an account. And the problem starts with the title.

00:01:08 — Maya
The title? Okay, I'm in. And you told me there's an AI story at the end, too.

00:01:13 — Alex
There is. And it's a heist. Someone broke into a service run by a popular AI coding tool, grabbed developers' saved AI keys, and ran up charges on them. Some people say they woke up to bills of more than seventeen hundred dollars. Stay for that one.

00:01:29 — Maya
Okay, that's a heist. Alright. Story one first.

00:01:34 — Alex
Meta launched a personal AI agent called Muse in the US on September eighth. When you ask, Muse can share a conversation. It makes a web page for that chat, and anyone with the link can open it. No login.

00:01:47 — Maya
So far that's a normal share link. Long random ID, impossible to guess.

00:01:53 — Alex
Here's the detail. According to the security firm Claroc, Muse built each share's web address from the conversation's title, plus a random ID. And it put that in the hostname. The name part, before Meta's domain.

00:02:07 — Maya
Wait. So if my chat was called quarterly revenue review, that's sitting in the address bar as the name of a website?

00:02:15 — Alex
As a subdomain, yes. Title, random ID, then Meta's content domain.

00:02:21 — Maya
Okay, but the random ID is still there. A stranger would still need the whole link.

00:02:26 — Alex
That's the question. How would a stranger ever see the whole link?

00:02:31 — Maya
They'd have to be looking over my shoulder. Or reading my messages.

00:02:35 — Alex
Or reading the internet's diary. Every time anyone opens a link, their computer first asks: where does this name live? That's a DNS lookup. The name goes out before the page loads.

00:02:48 — Maya
Sure, the phone book step. But the phone book doesn't remember who called.

00:02:53 — Alex
Some of them do. There are passive DNS services. They record the lookups their resolvers see, and keep those names searchable. Security people use them all the time. Normally they're full of boring names.

00:03:05 — Maya
Oh no. So when somebody opened a shared chat, the whole hostname, title and random ID, could land in a searchable database.

00:03:15 — Alex
That's what Claroc found. In their words, it took one query. After filtering out noise, more than six thousand eight hundred share hostnames came back.

00:03:25 — Maya
So only people with the link was true. The link just wrote itself into a public diary first.

00:03:32 — Alex
That might be the most DNS sentence anyone has ever said.

00:03:37 — Maya
What was in them? Please tell me it was mostly recipes.

00:03:41 — Alex
Mostly harmless, actually. Small business sites, listings, event calendars. But Claroc opened only a few hundred, and some were not harmless. A company's internal revenue review, marked for its CEO. A small business owner's loan application, with the amount requested. And someone's notes preparing for a confidential executive search call with an AI lab.

00:04:04 — Maya
That's someone's next career move, sitting in a phone book. Okay, but surely Meta told search engines to stay away?

00:04:12 — Alex
They did ask search engines not to crawl the pages. It just didn't matter. Nobody had to crawl anything. The names were already in the diary, and the pages opened without signing in. Claroc also found more than seventy five saved scans of share pages on a public URL scanning service.

00:04:30 — Maya
Right. Please don't crawl is a polite sign on the door. It's not a lock.

00:04:35 — Alex
Exactly. Claroc reported it to Meta on October eighth and published on October eighteenth. On October twentieth, Meta told Ars Technica it had paused the feature while it reviews the report. When Claroc rechecked forty shares that day, none of them opened. The pages are gone. But the hostnames, titles included, are still in passive DNS history.

00:04:57 — Maya
So the diary doesn't forget. Okay, I want the general rule, because I don't work at Meta. HTTPS encrypts the request. So why does moving the title into the name matter so much?

00:05:10 — Alex
Because the name travels outside that protection. Everything after the name, the path, goes inside the encrypted request. The name has to be looked up first, and that lookup isn't private. Resolvers see it, logs keep it, and here a database made it searchable.

00:05:27 — Maya
So the most public part of a link is the part we read as the website's name. And Muse put the most private thing, the title, right there.

00:05:36 — Alex
Right. A random ID in the path stays inside the encrypted request. The same ID in the hostname is a secret you've announced to every resolver on the way.

00:05:46 — Maya
Okay, now I'm thinking about every SaaS app that does customer name dot app dot com for each tenant.

00:05:52 — Alex
Plenty do. And preview environments named after branches. Feature, acquisition of whoever, dot staging, dot company dot com.

00:06:02 — Maya
So naming a branch secret layoff plan was always a bad idea. But now it's a bad idea with a DNS record.

00:06:11 — Alex
A searchable one. So here's the check for Monday. Search passive DNS and URL scanning services for your own domains, and see which names are already out there. Keep secrets, and anything a user typed, out of hostnames. Put them behind a login, or at least in the path.

00:06:29 — Maya
And treat anyone with the link as public. Because the link has a life you don't control.

00:06:35 — Alex
DNS is the internet's public diary. Don't write your secrets in it.

00:06:40 — Maya
Okay. You promised me a heist.

00:06:43 — Alex
I did. So, OpenCode. One of the most popular open source AI coding agents. They also run a service called Console, where a team saves its OpenAI, Anthropic or Google keys once, and everyone shares access.

00:06:57 — Maya
One place holding everybody's keys. I think I see where this is going.

00:07:02 — Alex
Yeah. On October seventeenth, OpenCode said someone got unauthorized access to a legacy system they were in the middle of shutting down. Keys saved in team workspaces may have been exposed. It hit one point four percent of Console users.

00:07:18 — Maya
One point four percent. That sounds small.

00:07:21 — Alex
Until it's your key. Users reported unauthorized charges from a few hundred dollars to more than seventeen hundred. Overnight. And some say Google suspended their projects for, quote, abusive activity consistent with hijacked resources.

00:07:37 — Maya
Overnight? What were they even doing with the keys?

00:07:40 — Alex
OpenCode's own words: a large scale distillation attack.

00:07:45 — Maya
Which is a fancy way of saying what?

00:07:48 — Alex
Copying a model's brain by asking it questions. You send a top model millions of prompts, save every answer, and train your own cheaper model to imitate it. And if you're using someone else's key...

00:08:00 — Maya
Someone else pays your tuition.

00:08:03 — Alex
Exactly. And here's the twist I love. OpenCode used AI models to help investigate. Their co-creator Dax Raad says the models, quote, did quite a bit and then started refusing. Once the work got into potentially malicious code, the safety filters kicked in.

00:08:20 — Maya
So the house is getting robbed, and the security guard says, sorry, I can't discuss burglary.

00:08:28 — Alex
Pretty much. They got unstuck when OpenAI approved them for Daybreak Blue, a program that gives vetted defenders models with fewer restrictions. And OpenAI, Google and Anthropic say they worked with affected customers to revoke the keys and deal with the charges.

00:08:44 — Maya
Okay, but who even does distillation at this scale?

00:08:48 — Alex
For this attack, nobody's said who. Separate story, same game. Last month, Anthropic accused Moonshot, the company behind Kimi, of distilling Claude. More than twenty three million exchanges in three months.

00:09:03 — Maya
Twenty three million?

00:09:05 — Alex
And that's not even the wild part. Anthropic says Moonshot silently forwarded some requests from Kimi users to Claude, and showed Claude's answers as if Kimi wrote them. Nearly three hundred thousand requests in one ten-day stretch, through more than five thousand accounts Anthropic calls fraudulent.

00:09:24 — Maya
Wait. So you ask Kimi, and Claude answers? That's not a model. That's a call center.

00:09:31 — Alex
With an outsourced brain. To be fair, those are Anthropic's findings from its own data, not a court ruling, and Moonshot hadn't responded publicly when the report came out. But back in July, a White House official had already said they had information that Moonshot distilled Claude to build Kimi K3. He didn't share evidence.

00:09:52 — Maya
And the Kimi users had no idea their prompts were going to another company?

00:09:56 — Alex
Anthropic says it doesn't know whether Moonshot told them. So, the practical part. An AI key is basically a credit card for a brain. Give every tool its own key, scoped to one project, with a spending limit and an alert. Never park a production key in a shared tool. And if you used OpenCode Console, rotate those keys and check your usage from October sixteenth.

00:10:19 — Maya
Which is kind of today's whole episode. A chat link leaked through DNS. Saved keys leaked from a system someone was in the middle of shutting down. Not the shiny front door. The forgotten plumbing.

00:10:32 — Alex
That's it. Now we want your story. What's the most secret thing you've ever found sitting in a hostname? Tell us in the comments.

00:10:40 — Maya
Branch names count. Thanks for listening to Development Radio.