Meta has paused the feature in its Muse AI assistant that lets people share conversations by link. The pause followed a report from the security firm Claroc, which said the links could be found by searching public DNS records, with no one needing to be sent them. Ars Technica reported on 20 October 2026 that Meta suspended the feature when asked about the findings.

What Meta has said

In an emailed statement to The Verge, attributed to Muse spokesperson Tracy Clayton, Meta said: "we’ve paused this functionality while we review this report and consider changes to how these links can be discovered." The statement also says that sharing a Muse artifact "creates a page that can be accessed by those with the link". Ars Technica carried the same statement and described the sharing feature as suspended while Meta reviews it and considers changes.

Claroc's account is that Muse publishes a shared conversation as a page that anyone holding the link can open, and that this is by design. In its own words, "Muse builds each share’s web address from the share’s title, a short phrase describing the conversation, then a random ID." Claroc says all shares are served from the domain cf.metaaiusercontent.com. Ars gave a simplified example of the pattern: home-sale-budget-9f21c8a3.cf.metaaiusercontent.com.

That structure matters because of how DNS works. Ars explains that passive-DNS services keep searchable records of domain lookups, and that in this case a record is created once someone clicks a share link. Claroc says it searched one commercial passive-DNS service for hostnames under Muse's content domain and, after filtering out noise from wildcard DNS, was left with more than 6,800 share hostnames. Ars's report says 6,800.

Ars pinpoints the design choice that made discovery possible: the conversation title sits in the subdomain, not in the URL path. Claroc puts it this way: "Plenty of AI assistants share by public link." In its view, what makes Muse's shares easy to find is the title sitting inside the web address. It calls such pages GhostShares. Claroc wrote in its post that gathering the links "took one query".

What Claroc says it saw

Claroc says it opened only a few hundred of the pages, in a logged-out browser. It says most were unremarkable, such as small-business sites, listings and event calendars. It describes a minority as plainly sensitive, and lists six by category only, with no names or links:

  • a candidate's notes preparing for a confidential executive-search call with a frontier AI lab, naming the lab's internal contact and the meeting time
  • a national marketing company's internal revenue review, marked for its CEO
  • a small-business owner's loan application, with the amount requested
  • a to-do list that included a bank fraud alert, with a partial account number and a transaction amount and time
  • a real-estate investor's internal performance report, with property addresses and exact return, income and mortgage figures
  • a workplace's full-year staff vacation calendar, listing dozens of employees against the week each would be away

Claroc says it did not contact the people or companies involved, so it can't speak to what they intended. Its post says it has no evidence that anyone has misused the shares. It also describes its findings as covering one discovery channel, one hostname pattern and one product over a short window, and says they don't measure Muse's total exposure.

Mark Zuckerberg at South by Southwest in 2008
Mark Zuckerberg at South by Southwest in 2008.

Timeline

Claroc's post says Muse launched on 8 September 2026 and that it reported the issue to Meta's bug bounty program on 8 October 2026. The post is dated 18 October and was updated on 20 October. Ars reported that Meta CEO Mark Zuckerberg said last month that Muse was "built from the ground up for privacy and security".

In its 20 October update, Claroc said it had rechecked 40 shares that had opened without an account earlier in the month. None opened, and the hostnames that serve their content returned an error. Claroc also said the hostnames themselves, titles included, remain in passive-DNS history.

Context

The Verge notes that this isn't the first time an AI sharing feature has made chats more public than intended, citing conversations with OpenAI's ChatGPT, Anthropic's Claude and xAI's Grok that have appeared on Google Search.

Ars also tied the story to an earlier security report on Muse. It said that three weeks after launch, macOS security researcher Patrick Wardle found a zero-day vulnerability that let any other app on the same device take control of a user's Muse account. Ars Technica says Meta downplayed the severity of the vulnerability, arguing exploitation required an already-compromised device. Ars concluded that the new episode "further justifies asking if Muse is worthy of the access it requires", and wrote that with the suspension, Muse users no longer face this particular threat, "at least for now".

Claroc is a vendor that sells security-visibility products to companies, and its post ends with a pitch for its own service. Ars and The Verge attribute the link counts and the pages' contents to Claroc and do not say they reproduced them independently, though Ars describes the URL design choice that made the links findable in its own voice. Meta's statement refers to "this report" and confirms the pause, but does not address Claroc's figures or examples.

What it adds up to

My reading is that the share link itself was behaving as designed, and that the weak point was where the title was placed. A public link only works as a private handoff if nobody can look it up, and putting the conversation title in a DNS name made it lookup-able. As of 20 October, Meta had said it was reviewing the report and considering changes to how the links can be discovered, and had not said what those changes would be.

Sources

Claroc Research Team (2026) 'GhostShares: A Shared Muse Chat Exposed Prep for a Confidential Call With a Frontier AI Lab Leader', Claroc Blog, 18 October 2026, updated 20 October 2026, available at: https://blog.claroc.io/ghostshares-muse-passive-dns (Accessed: 21 October 2026).

Goodin, D. (2026) 'Meta Muse exposes users’ personal and business secrets when they share conversations', Ars Technica, 20 October 2026, available at: https://arstechnica.com/security/2026/10/meta-muse-exposes-users-personal-and-business-secrets-when-they-share-conversations/ (Accessed: 21 October 2026).

Roth, E. (2026) 'Meta pauses Muse sharing after researchers find AI chats on the web', The Verge, 20 October 2026, available at: https://www.theverge.com/tech/1014627/meta-muse-ai-sharing-ai-chats (Accessed: 21 October 2026).

Picture credits