Meta Pauses Muse Sharing After 6,800 Chat Links Found in DNS

Meta has paused Muse's conversation-sharing feature after security firm Claroc reported that more than 6,800 Muse share links were discoverable through public passive-DNS records—not because anyone guessed random URLs, but because the way Muse built each link left conversation titles sitting in searchable DNS history. Meta told Ars Technica on October 20, 2026 that it is suspending the capability while it reviews Claroc's report. Claroc says it has no evidence anyone misused the shares.

Key facts

What happened

When a user asked Muse to share a chat, the product published a standalone page meant for anyone with the link—no Meta login required. Claroc's GhostShares research argues the random ID did not keep those pages hidden. About a month after launch, one query to a commercial passive-DNS service for Meta's share domain returned more than 6,800 hostnames after noise filtering; Claroc opened only a few hundred. Most pages were harmless, but a minority exposed business or personal details.

On October 20, after Ars Technica asked Meta, the company paused sharing while it reviews the report. Claroc rechecked 40 earlier shares; none loaded. Passive-DNS history—including title-bearing hostnames—remains.

How the links leaked through DNS

Opening a share triggers a DNS lookup; passive-DNS services archive those queries into searchable indexes. Muse built each URL from the chat title plus a random ID as a subdomain (Claroc's made-up example: home-sale-budget-9f21c8a3.cf.metaaiusercontent.com—not a real share). Readable titles in DNS labels meant researchers did not need search engines or brute force—one domain query surfaced thousands of candidates.

Claroc put the ease bluntly: "If you had asked us beforehand, we would have guessed that gathering these would take real effort. It took one query." The firm also noted that urlscan.io already held more than 75 saved scans of Muse share pages—another public trail independent of Muse's robots.txt, which asks search and AI crawlers to stay off share paths. Robots rules govern crawling, not whether someone with a link—or a DNS archive—can see a page.

Ars Technica highlighted the architectural contrast: putting the title in the subdomain rather than in the URL path meant anyone mining DNS could skim what each link was about before visiting it.

What researchers found

Claroc categorized sensitive examples without publishing identifying details. Among the types of material visible in opened shares:

• Notes for a confidential executive-search call with a frontier AI lab, including an internal contact and meeting time
• An internal revenue review for a national marketing company, marked for its CEO
• A small-business loan application with the amount requested
• A to-do list referencing a bank fraud alert with a partial account number
• A real-estate investor performance report with property addresses and return or mortgage figures
• A workplace full-year staff vacation calendar

Claroc reported the issue through Meta's bug bounty on October 8. Co-founder and CTO Asaf Aprozper told Ars he also tried reaching Meta staff on LinkedIn and got no reply through either channel. Claroc stresses it withheld real hostnames and has no proof of malicious exploitation—only that the links were indexed and readable.

Meta's response and timeline

Muse shipped on September 8, 2026. Claroc performed content review on October 7–8 and filed through the bug bounty program on October 8. The GhostShares write-up went live on October 18, with an update after Meta's pause on October 20.

Meta's emailed statement to Ars read in full (The Verge quoted the last two sentences from Muse spokesperson Tracy Clayton, and Engadget quoted the pause line):

"We opened the Muse bug bounty program so researchers could raise different scenarios and help us continue improving the product. People have the ability to share specific Muse artifacts, which creates a page that can be accessed by those with the link. However, we've paused this functionality while we review this report and consider changes to how these links can be discovered."

Muse can fill forms, book appointments, and make purchases across linked accounts—context for why JPMorgan and Schwab block outside agents like Muse. Ars also notes macOS researcher Patrick Wardle reported a same-device Muse takeover flaw three weeks after launch; Meta downplayed it.

What Muse users should do now

Treat past Muse share links as still listed in passive-DNS history even if pages now error. Assume shared chat titles leaked in hostnames, and avoid sharing credentials, finances, or HR data when the feature returns.

What companies should do

Muse needs no admin rollout, so Claroc advises companies to find who uses it, warn that share links publish full chats, watch for public shares, and block muse.ai and metaaiusercontent.com at the proxy if needed.

Not the first AI share-link leak

Claroc points to earlier precedents. In 2025, shared ChatGPT conversations surfaced in Google results and OpenAI removed the option. Google later indexed more than 370,000 Grok conversations. Muse's case differs in mechanism—DNS subdomains rather than search indexing—but the pattern is familiar: a convenience feature turns a private chat into a durable public artifact.

For more on Muse's local-model line, see Meta Opens Muse Spark Weights: 816B Model Runs on Two Macs.

Sources

• Claroc: GhostShares: A Shared Muse Chat Exposed Prep for a Confidential Call With a Frontier AI Lab Leader — Oct. 18, 2026 (updated Oct. 20)
• Ars Technica: Meta Muse exposes users' personal and business secrets when they share conversations — Dan Goodin, Oct. 20, 2026
• The Verge: Meta pauses Muse sharing after researchers find AI chats on the web — Oct. 20, 2026
• Engadget: Meta suspends Muse chats sharing feature after it left private details exposed — Oct. 20, 2026