Meta Suspends Muse Chat Sharing After Researchers Find Links in Public DNS

Meta is suspending the conversation link-sharing feature in its Muse AI agent after security firm Claroc found more than 6,800 Muse share hostnames listed by readable conversation title in public passive-DNS records, Claroc said in an October 20, 2026 update to its GhostShares research.

According to the update, Meta told Ars Technica it was suspending the feature after the outlet asked about the findings, and Claroc said it was “glad to see it closed this quickly.” When Claroc rechecked 40 shares on October 20, 2026 that had opened without an account earlier in the month, none opened, and the hostnames serving their content returned an error, the firm said. The hostnames themselves, conversation titles included, remain in passive-DNS history.

Claroc published the underlying research on October 18, 2026, naming the findable shares GhostShares: pages that open for people who were never handed the link and that those people can locate on their own. Muse launched on September 8, 2026, and Claroc ran its search against a passive-DNS dataset about a month later.

How Shared Chats Became Searchable

Muse publishes a shared conversation as a page that opens for anyone holding the link, without a login, and Muse shares only by link. According to Claroc, Muse builds each share’s web address from the conversation’s own title plus a random ID, served from hostnames under cf.metaaiusercontent.com, the content domain Muse serves shares from. When someone opens a share, the browser resolves that hostname, and passive-DNS providers whose resolvers observe the lookup record it and keep it searchable, so the title a user typed lands in a public index of domain names.

Claroc searched one commercial passive-DNS service for Muse’s content domain and, after filtering out wildcard-DNS scan noise, found more than 6,800 share hostnames listed by title. The firm opened only a few hundred of them and said almost every live share opened on sight, without an account. Passive DNS was not the only place the shares surfaced: urlscan.io, a public URL-scanning service anyone can query, already held more than 75 saved scans of Muse share pages, according to the research.

Muse’s robots.txt asks search and AI crawlers to stay off the share paths, but Claroc noted that robots.txt governs crawling rather than access, and its discovery never went near a search engine. Each address carries a random ID long enough that nobody could guess it, yet the first time anyone opens a share, DNS logs the full hostname, ID included. Claroc said this class of leak has precedent: in 2025, shared ChatGPT conversations surfaced in Google results and OpenAI removed the option that made them indexable, and Google later indexed more than 370,000 Grok conversations.

What the Exposed Pages Held

Most of the shares Claroc opened were unremarkable, but a minority were sensitive, the firm said. It described six by category only, withholding names and links: a candidate’s notes preparing for a confidential executive-search call with a frontier AI lab, naming the lab’s internal contact and the meeting time; a national marketing company’s internal revenue review marked for its CEO; a small-business owner’s loan application with the amount requested; a to-do list containing a bank fraud alert with a partial account number and a transaction amount and time; a real-estate investor’s internal performance report with two property addresses and exact return, income and mortgage figures; and a workplace’s full-year staff vacation calendar listing dozens of employees against the weeks each would be away.

Claroc said it reached every page without being given its link, working from a domain-lookup dataset with no account, and that it did not log in, fill in a form, or upload anything; one page asked for a password and the firm left it. Every severity judgment came from a person reading the page, the firm said. Claroc stated it has no evidence anyone misused the shares, that it did not contact the people or companies involved, and that the two companies whose documents it found are real, confirmed against public sources. It characterized its findings as one discovery channel, one hostname pattern and one product over a short window, rather than a measure of Muse’s total exposure.

Disclosure Timeline and Meta’s Documented Model

Claroc reported the issue to Meta’s bug bounty program on October 8, 2026, with reproduction steps and example shares. Its content checks were made during collection on October 7 and 8, 2026, and on October 18, 2026 it re-opened the call-prep share once, and no others, to capture a redacted screenshot. Passive DNS showed the share tier still minting new hostnames, 27 on the day Claroc last looked, which the firm described as continued discovery rather than re-verified access.

Meta’s Help Center documentation for sharing a link to an AI conversation states that “people with the link will be able to see your conversation,” that the link does not expire, and that people can share the link onward. The conversation is captured at the point the link is created, and deleting the link cuts off access for people who received it. The page advises users to be mindful when sharing a link to a conversation in which they discussed personal information or circumstances. Claroc noted the page documents Meta AI rather than Muse specifically, but described it as the closest published description Meta gives of how one of its AI share links behaves.

Meta’s separate Muse privacy and security documentation states that every Muse user’s cloud virtual machine is isolated so no one else’s agent can access it, that Muse does not share conversations or virtual-machine data with Meta ad systems, and that credentials for connected apps sit in a Secure Credentials Store that lets Muse complete authorized actions without the AI model seeing passwords.

Claroc said it is withholding every identifier, including hostnames, titles, figures and links, so that nothing in its report points readers at affected content, and that it will delete its stored discovery data once Meta confirms it has what it needs.