Meta has paused the chat-sharing feature of Muse, its personal AI agent, after security researchers showed that shared conversations could be found by anyone — not just the people they were sent to. Researchers at Claroc enumerated more than 6,800 shared Muse chats through public DNS records, because Muse builds each share’s web address out of the conversation’s own title.
Ars Technica first reported the findings on October 20, and Meta moved the same day. “We’ve paused this functionality while we review this report and consider changes to how these links can be discovered,” a Meta spokesperson told The Verge, and Claroc says that when it rechecked 40 shares on October 20 that had previously opened without an account, none of them opened, with the hostnames serving their content returning an error.
How Muse Share Links Ended Up In Public DNS
Sharing in Muse works by link: ask the agent to share a conversation and it publishes the conversation as a page that opens for anyone holding the link, with no login required — a design Meta’s own help documentation describes as a link that does not expire and can be reshared. The problem sits in the address itself. Muse names each share’s hostname, under its content domain cf.metaaiusercontent.com, after the conversation’s title, followed by a random ID.
That construction defeats the ID’s purpose. The first time anyone opens a share, their browser resolves the hostname, and passive-DNS services — databases that record how domain names resolve, searchable like a phone book for the internet — log the whole hostname, title and supposedly unguessable ID together. One passive-DNS query against the Muse content domain returned Claroc more than 6,800 share hostnames after filtering, listed by name, in the researchers’ words, “like a table of contents.” The same pages also surface in urlscan.io, a public URL-scanning service, which already holds more than 75 saved scans of Muse share pages.
What The Exposed Muse Chats Contained
Claroc opened only a few hundred of the shares and says most were harmless. A minority were not. The firm lists, by category only and with all identifiers withheld: a candidate’s confidential preparation for an executive-search call with a frontier AI lab, naming the lab’s internal contact and the exact meeting time; a national marketing company’s internal revenue review prepared for its CEO; a small-business owner’s loan application with the amount requested; a to-do list containing a bank fraud alert with a partial account number; a real-estate investor’s internal performance report with property addresses and exact return, income and mortgage figures; and a workplace’s full-year staff vacation calendar naming dozens of employees against their weeks away.
Claroc reported the issue to Meta’s bug bounty programme on October 8, says it has no evidence anyone misused the shares, and plans to delete its stored discovery data once Meta confirms it has what it needs. The hostnames, titles included, remain in passive-DNS history even after the pause.
A Familiar Failure: ChatGPT And Grok Shares Leaked The Same Way
This class of leak has hit Muse’s rivals before. In 2025, shared ChatGPT conversations surfaced in Google search results and OpenAI pulled the option that made them indexable; weeks later, Google had indexed more than 370,000 Grok conversations. Muse did take the search precaution — its robots.txt asks search and AI crawlers to stay off the share paths — but robots.txt governs crawling, not access or discovery, and Claroc’s route never went near a search engine. The lesson the researchers draw is that a share link is only as private as its address, and a hostname is never a secret.
Why It Matters
The central entity is Muse’s share link, and its decisive attribute is discoverability: a feature designed for one-to-one sending became a public, searchable index of what users had shared, titles included. That lands on a product already under privacy scrutiny — days ago a Muse agent shared a seller’s home address with a Marketplace buyer — and it widens the gap between Muse’s ambitions, backed by infrastructure on the scale of the Prometheus supercluster, and the basic safeguards users assume a share button carries. For employers, Claroc’s warning is practical: Muse needs no admin rollout, so staff can already be publishing internal documents through it, and security teams should treat any AI “share link” as an outbound transfer. How Meta redesigns the links — and whether the DNS history can be scrubbed — will decide whether Meta AI’s agent can be trusted with the personal and business context it is built to hold.
Background
Muse is Meta’s personal AI agent, launched on September 8, 2026 as the company’s push beyond chatbots toward an assistant that acts for users across its apps and the web. Within six weeks it has drawn two public privacy failures — the Marketplace address disclosure and now the GhostShares exposure — each rooted not in the model’s answers but in how the product handles the personal information users hand it.
Source: Claroc (primary research, “GhostShares”); Engadget, reporting Ars Technica’s first report and Meta’s statement
0 Comments