Meta has temporarily disabled Muse AI’s conversation sharing feature after researchers discovered a privacy flaw that made some shared pages—and the confidential business records and personal details they contained—discoverable via chat links.
The issue affected only pages that users explicitly chose to share, not all private Muse conversations. Anyone who located an exposed share link could open its contents without signing in.
Claroc, the security research team that found the problem, traced the exposure to the way Muse constructed shared-page addresses. Each shared page used a hostname that combined a human-readable conversation title with a random identifier. Those complete hostnames were observable in passive DNS records—services that log domain lookups—which provided a means to find shared pages without receiving the link from the owner.
Claroc named the discovery “GhostShares.” Their report frames the issue as a sharing design weakness rather than malware or a confirmed targeted attack. After checking pages on October 7 and 8, 2026, they reported the issue to Meta’s bug bounty program on October 8, 2026.
Muse placed shared content under the domain cf.metaaiusercontent.com. Although the random identifier component made blind guessing difficult, passive DNS preserved the full hostnames—including the supposedly secret identifier—when participating DNS resolvers observed lookups. Using those passive DNS records, researchers were able to reconstruct working share links without needing to guess passwords, steal accounts, or bypass authentication.
This method of discovery differs from earlier exposures of shared chatbot conversations that relied on search engine indexing. Because the GhostShares discovery used DNS history rather than search indexes, crawler restrictions such as robots.txt did not prevent the hostnames from being recorded. Muse’s robots.txt did ask search and AI crawlers to avoid share paths, but that file cannot stop DNS resolvers from logging lookups or block other discovery routes. Claroc also found more than 75 archived scans of Muse share pages on urlscan.io, demonstrating an additional route for exposure.
After filtering out unrelated wildcard DNS scan noise, Claroc identified more than 6,800 distinct share hostnames. The researchers opened only a few hundred of those pages, so the total count does not imply that 6,800 sensitive conversations were confirmed exposed.
Most of the inspected pages contained ordinary content; a minority held sensitive records. Claroc cited examples that included a marketing company’s revenue review marked for its CEO, a small business loan application, a property investor’s financial report, a bank fraud alert with partial account details, a staff vacation calendar, and confidential preparation notes for an executive search call with a frontier AI laboratory (including an internal contact and meeting time). Such details could enable impersonation or targeted fraud if disclosed.
Claroc reported no evidence that the exposed content was abused. To limit harm, the researchers withheld affected names, hostnames, titles, figures, and links from their disclosure. They also noted a technical detail: Muse initially returned only the share title in a simple fetch, with JavaScript loading the full conversation afterward. Because of that behavior, a basic HTTP fetch can miss content that appears during a normal browser session. Claroc used ordinary browser sessions without accounts and stopped when a page requested a password.
The researchers did not contact the affected people or businesses, so they could not determine whether those users intended their documents to be publicly accessible.
Meta pauses sharing while issues are reviewed
On October 20, 2026, Meta said it had paused the Muse sharing feature while it reviewed Claroc’s findings and considered changes to link generation and discovery. Claroc revisited 40 previously accessible shares that day; none opened and their content hostnames returned errors. However, historical DNS records continued to retain the hostnames and titles.
That distinction is important: preventing access to a page does not erase information that has already been recorded elsewhere. Past incidents of indexed shared chatbot conversations underscore the broader risk of treating publicly shared links as private collaboration tools.
Claroc’s sample was limited and cannot establish the total scope of Muse’s exposure, how long individual pages remained available, or whether third parties accessed specific shares.
Organizations should review employee use of Muse, check whether business conversations were shared, and clarify that public share links are not restricted to named recipients. Claroc recommends treating share creation as a possible outbound data transfer and, where adequate controls are not available, blocking access to muse.ai and metaaiusercontent.com via managed proxies or DNS filtering.
Indicators of compromise (IoCs)
| Type | Source value | Security relevance |
|---|---|---|
| Application domain | muse.ai |
Review employee access and sharing activity. |
| Content domain | metaaiusercontent.com |
Recommended blocking target where controls are unavailable. |
| Share content domain | cf.metaaiusercontent.com |
Domain associated with discoverable shared page hostnames. |
| Hashes and SHA values | Not published | No malware or file-based indicators supplied. |
Note: IP addresses and domains in some reports are intentionally defanged (for example, by replacing dots with [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat-intelligence platforms such as MISP, VirusTotal, or your SIEM.
Security teams: monitor for new threats and integrate threat intelligence feeds with your SOC data sources to respond promptly to emerging risks.
