**00:00:02 — Maya:** Welcome to Development Radio. I'm Maya, here with Alex. Today's story starts with something we all do without thinking: you click share, you copy the link, you send it. Alex, when a page says anyone with the link can view, do you believe it?

**00:00:18 — Alex:** I believe it the way I believe this will only take five minutes. Technically possible. Emotionally, I have questions.

**00:00:26 — Maya:** That's fair. I send those links all the time. Usually to one person. Sometimes to a group chat, which is basically publishing.

**00:00:35 — Alex:** A group chat is a press release with emoji. But the link itself feels private, right? It's long, it's random, nobody could guess it.

**00:00:43 — Maya:** Exactly. It feels like a key. If you don't have the key, you don't get in. And somewhere there's a document called do not forward that its own author forwarded.

**00:00:54 — Alex:** That title is doing a lot of work. Okay. Today's story is about shared links that leaked without anybody forwarding them. Nobody guessed them, nobody hacked an account. And the problem starts with the title.

**00:01:08 — Maya:** The title? Okay, I'm in. And you told me there's an AI story at the end, too.

**00:01:13 — Alex:** There is. And it's a heist. Someone broke into a service run by a popular AI coding tool, grabbed developers' saved AI keys, and ran up charges on them. Some people say they woke up to bills of more than seventeen hundred dollars. Stay for that one.

**00:01:29 — Maya:** Okay, that's a heist. Alright. Story one first.

**00:01:34 — Alex:** Meta launched a personal AI agent called Muse in the US on September eighth. When you ask, Muse can share a conversation. It makes a web page for that chat, and anyone with the link can open it. No login.

**00:01:47 — Maya:** So far that's a normal share link. Long random ID, impossible to guess.

**00:01:53 — Alex:** Here's the detail. According to the security firm Claroc, Muse built each share's web address from the conversation's title, plus a random ID. And it put that in the hostname. The name part, before Meta's domain.

**00:02:07 — Maya:** Wait. So if my chat was called quarterly revenue review, that's sitting in the address bar as the name of a website?

**00:02:15 — Alex:** As a subdomain, yes. Title, random ID, then Meta's content domain.

**00:02:21 — Maya:** Okay, but the random ID is still there. A stranger would still need the whole link.

**00:02:26 — Alex:** That's the question. How would a stranger ever see the whole link?

**00:02:31 — Maya:** They'd have to be looking over my shoulder. Or reading my messages.

**00:02:35 — Alex:** Or reading the internet's diary. Every time anyone opens a link, their computer first asks: where does this name live? That's a DNS lookup. The name goes out before the page loads.

**00:02:48 — Maya:** Sure, the phone book step. But the phone book doesn't remember who called.

**00:02:53 — Alex:** Some of them do. There are passive DNS services. They record the lookups their resolvers see, and keep those names searchable. Security people use them all the time. Normally they're full of boring names.

**00:03:05 — Maya:** Oh no. So when somebody opened a shared chat, the whole hostname, title and random ID, could land in a searchable database.

**00:03:15 — Alex:** That's what Claroc found. In their words, it took one query. After filtering out noise, more than six thousand eight hundred share hostnames came back.

**00:03:25 — Maya:** So only people with the link was true. The link just wrote itself into a public diary first.

**00:03:32 — Alex:** That might be the most DNS sentence anyone has ever said.

**00:03:37 — Maya:** What was in them? Please tell me it was mostly recipes.

**00:03:41 — Alex:** Mostly harmless, actually. Small business sites, listings, event calendars. But Claroc opened only a few hundred, and some were not harmless. A company's internal revenue review, marked for its CEO. A small business owner's loan application, with the amount requested. And someone's notes preparing for a confidential executive search call with an AI lab.

**00:04:04 — Maya:** That's someone's next career move, sitting in a phone book. Okay, but surely Meta told search engines to stay away?

**00:04:12 — Alex:** They did ask search engines not to crawl the pages. It just didn't matter. Nobody had to crawl anything. The names were already in the diary, and the pages opened without signing in. Claroc also found more than seventy five saved scans of share pages on a public URL scanning service.

**00:04:30 — Maya:** Right. Please don't crawl is a polite sign on the door. It's not a lock.

**00:04:35 — Alex:** Exactly. Claroc reported it to Meta on October eighth and published on October eighteenth. On October twentieth, Meta told Ars Technica it had paused the feature while it reviews the report. When Claroc rechecked forty shares that day, none of them opened. The pages are gone. But the hostnames, titles included, are still in passive DNS history.

**00:04:57 — Maya:** So the diary doesn't forget. Okay, I want the general rule, because I don't work at Meta. HTTPS encrypts the request. So why does moving the title into the name matter so much?

**00:05:10 — Alex:** Because the name travels outside that protection. Everything after the name, the path, goes inside the encrypted request. The name has to be looked up first, and that lookup isn't private. Resolvers see it, logs keep it, and here a database made it searchable.

**00:05:27 — Maya:** So the most public part of a link is the part we read as the website's name. And Muse put the most private thing, the title, right there.

**00:05:36 — Alex:** Right. A random ID in the path stays inside the encrypted request. The same ID in the hostname is a secret you've announced to every resolver on the way.

**00:05:46 — Maya:** Okay, now I'm thinking about every SaaS app that does customer name dot app dot com for each tenant.

**00:05:52 — Alex:** Plenty do. And preview environments named after branches. Feature, acquisition of whoever, dot staging, dot company dot com.

**00:06:02 — Maya:** So naming a branch secret layoff plan was always a bad idea. But now it's a bad idea with a DNS record.

**00:06:11 — Alex:** A searchable one. So here's the check for Monday. Search passive DNS and URL scanning services for your own domains, and see which names are already out there. Keep secrets, and anything a user typed, out of hostnames. Put them behind a login, or at least in the path.

**00:06:29 — Maya:** And treat anyone with the link as public. Because the link has a life you don't control.

**00:06:35 — Alex:** DNS is the internet's public diary. Don't write your secrets in it.

**00:06:40 — Maya:** Okay. You promised me a heist.

**00:06:43 — Alex:** I did. So, OpenCode. One of the most popular open source AI coding agents. They also run a service called Console, where a team saves its OpenAI, Anthropic or Google keys once, and everyone shares access.

**00:06:57 — Maya:** One place holding everybody's keys. I think I see where this is going.

**00:07:02 — Alex:** Yeah. On October seventeenth, OpenCode said someone got unauthorized access to a legacy system they were in the middle of shutting down. Keys saved in team workspaces may have been exposed. It hit one point four percent of Console users.

**00:07:18 — Maya:** One point four percent. That sounds small.

**00:07:21 — Alex:** Until it's your key. Users reported unauthorized charges from a few hundred dollars to more than seventeen hundred. Overnight. And some say Google suspended their projects for, quote, abusive activity consistent with hijacked resources.

**00:07:37 — Maya:** Overnight? What were they even doing with the keys?

**00:07:40 — Alex:** OpenCode's own words: a large scale distillation attack.

**00:07:45 — Maya:** Which is a fancy way of saying what?

**00:07:48 — Alex:** Copying a model's brain by asking it questions. You send a top model millions of prompts, save every answer, and train your own cheaper model to imitate it. And if you're using someone else's key...

**00:08:00 — Maya:** Someone else pays your tuition.

**00:08:03 — Alex:** Exactly. And here's the twist I love. OpenCode used AI models to help investigate. Their co-creator Dax Raad says the models, quote, did quite a bit and then started refusing. Once the work got into potentially malicious code, the safety filters kicked in.

**00:08:20 — Maya:** So the house is getting robbed, and the security guard says, sorry, I can't discuss burglary.

**00:08:28 — Alex:** Pretty much. They got unstuck when OpenAI approved them for Daybreak Blue, a program that gives vetted defenders models with fewer restrictions. And OpenAI, Google and Anthropic say they worked with affected customers to revoke the keys and deal with the charges.

**00:08:44 — Maya:** Okay, but who even does distillation at this scale?

**00:08:48 — Alex:** For this attack, nobody's said who. Separate story, same game. Last month, Anthropic accused Moonshot, the company behind Kimi, of distilling Claude. More than twenty three million exchanges in three months.

**00:09:03 — Maya:** Twenty three million?

**00:09:05 — Alex:** And that's not even the wild part. Anthropic says Moonshot silently forwarded some requests from Kimi users to Claude, and showed Claude's answers as if Kimi wrote them. Nearly three hundred thousand requests in one ten-day stretch, through more than five thousand accounts Anthropic calls fraudulent.

**00:09:24 — Maya:** Wait. So you ask Kimi, and Claude answers? That's not a model. That's a call center.

**00:09:31 — Alex:** With an outsourced brain. To be fair, those are Anthropic's findings from its own data, not a court ruling, and Moonshot hadn't responded publicly when the report came out. But back in July, a White House official had already said they had information that Moonshot distilled Claude to build Kimi K3. He didn't share evidence.

**00:09:52 — Maya:** And the Kimi users had no idea their prompts were going to another company?

**00:09:56 — Alex:** Anthropic says it doesn't know whether Moonshot told them. So, the practical part. An AI key is basically a credit card for a brain. Give every tool its own key, scoped to one project, with a spending limit and an alert. Never park a production key in a shared tool. And if you used OpenCode Console, rotate those keys and check your usage from October sixteenth.

**00:10:19 — Maya:** Which is kind of today's whole episode. A chat link leaked through DNS. Saved keys leaked from a system someone was in the middle of shutting down. Not the shiny front door. The forgotten plumbing.

**00:10:32 — Alex:** That's it. Now we want your story. What's the most secret thing you've ever found sitting in a hostname? Tell us in the comments.

**00:10:40 — Maya:** Branch names count. Thanks for listening to Development Radio.