Meta pauses Muse chat sharing after researchers find 6,800 links via public DNS

Meta paused the share feature of its Muse AI agent on 20 October 2026 after security firm Claroc showed that shared conversations could be found through public DNS records [1][2]. Claroc says it found more than 6,800 share links and opened a few hundred, some containing personal and business documents [1].

How could strangers find shared Muse chats?

Muse publishes a shared conversation as a page anyone with the link can open, without a login, Claroc says [1]. It builds each page's web address from the share's title plus a random ID, on the domain cf.metaaiusercontent.com [1][2].

Once someone opens a share, the full hostname can be recorded by passive-DNS services, which log domain lookups over time [2]. Claroc found more than 6,800 Muse share hostnames by searching a commercial passive-DNS service. The public scanning site urlscan.io held more than 75 saved scans of Muse share pages as well [1].

What was exposed?

Claroc says most of the pages it opened were harmless, but a minority were not [1]. Among them, according to Claroc and Ars Technica, were a candidate's notes for a confidential executive-search call with a frontier AI lab, a CEO-only revenue review, a small-business loan application, a to-do note with a bank fraud alert and partial account number, and a staff vacation calendar [1][2].

Claroc calls such pages GhostShares, because people who were never handed the link can find them on their own [1].

What did Meta say?

Meta paused Muse's sharing feature on 20 October 2026 after Ars Technica asked about the findings. In a statement, Meta said people can share specific Muse artifacts via a link page and that it paused the functionality while it reviews the report and considers changes to how the links can be discovered [2][3].

Asaf Aprozper of Claroc said he reported the issue through Meta's bug bounty programme on 8 October. He told Ars he also tried to reach people at Meta on LinkedIn and got no reply either way [2].

Muse launched on 8 September 2026, Claroc notes [1]. TechCrunch, citing Sensor Tower, reported on 20 October that Muse has reached 10 million US downloads in its first 40 days [4].

Our read

Opinion: Putting a chat's title into a hostname is a small design choice with a big blast radius, because DNS is a public record. For an agent that asks for access to most of a user's accounts, sharing should be private by default, not merely hard to guess.

What we could not verify

• How many of the 6,800 shares contained sensitive data; Claroc opened only a few hundred.
• Whether anyone other than the researchers accessed the exposed pages.
• When or how Meta will restore sharing.