SafetyRisk, alignment & guardrails
Meta pauses Muse chat sharing after Claroc finds more than 6,800 share links in passive-DNS records
Meta's Muse agent gave each shared chat its own subdomain containing a title and random ID. Passive-DNS logs captured those hostnames, letting researchers rebuild links and open private business conversations without logging in. Meta suspended sharing on October 20.
From the The Verge · AI article of October 20, 2026 and cited sources: The flaw was in how the links were built, not in search indexing. [2] [1] [7]
SOURCES[2] Claroc — GhostShares: Meta's Muse Exposed Prep for a… blog.claroc.io[1] Meta pauses Muse sharing after researchers find AI chats… theverge.com[7] GIGAZINE — Bug in Meta's Muse exposes shared conversations gigazine.net
AT Pulse research deskPublished · Updated · 5 min read · AI-assisted analysisAI-assisted, not human-edited. Methodology Corrections Who owns this site
- Original source
- The Verge · AI article, independent perspective
- Brief by
- AT Pulse research desk AI-assisted; publisher and contact on the desk page
- When
- October 20, 2026 article published
- Covered
- Oct 21 edition
- Evidence
- 9 sources across 9 sites
- 1Meta pauses Muse sharing after researchers find AI chats…theverge.com
- 2Claroc — GhostShares: Meta's Muse Exposed Prep for a…blog.claroc.io
- 3Unite.AI — Meta Suspends Muse Chat Sharing After…unite.ai
- 4iClarified — Meta launches Muse, a personal AI agenticlarified.com
- 5Slashdot — Meta Muse Exposes Users' Personal, Business…yro.slashdot.org
- 6TechRepublic — Meta Launches Muse AI Agenttechrepublic.com
Reach: not measured yet
The flaw was in how the links were built, not in search indexing. Each Muse share sat on its own subdomain under cf.metaaiusercontent.com. That subdomain combined a readable title slug with a random ID. Opening a share triggers a DNS lookup, and passive-DNS sensors record those lookups. So the full link could be rebuilt from DNS records alone, with no guessing or brute force. Using one commercial passive-DNS service, Claroc collected more than 6,800 hostnames. It opened a few hundred without logging in and found material such as a CEO's revenue review, a loan application and staff vacation calendars. [2] [1] [7]
Claroc reported the issue to Meta's bug bounty program on October 8. Meta suspended sharing only on October 20, after Ars Technica asked about the findings. A Muse spokesperson said Meta would consider changing how links can be discovered. On October 20, Claroc retested 40 shares that had opened earlier in October, and none of them loaded. [2] [5] [1] [3]
Earlier exposures of shared ChatGPT, Grok and Claude chats happened through search crawlers. This one happened through DNS infrastructure, so blocking crawlers would not have stopped it. More than 75 Muse share pages were also stored on the public scanner urlscan.io. For builders, the lesson is to keep per-share secrets out of hostnames and to use shares that require login or expire. [8] [3] [1]
Muse share links did not expire, needed no login, and leaked through DNS logs rather than search crawlers.
Read the full assessment
Implication: blocking indexing is not enough when an agent connected to email or finance tools can turn a casual share into lasting public exposure.
Executive brief
Researchers did not have to break into anything to read private Meta Muse chats. Security firm Claroc pulled more than 6,800 Muse share addresses from one commercial passive-DNS service. Each address carried the conversation's title in readable form, so the list itself showed what each page contained. Claroc opened a few hundred without logging in and found a CEO's revenue review, a small-business loan application and a staff vacation calendar (Claroc). Meta has paused sharing while it reviews the report (The Verge). Search engines played no part in this leak. The problem was in how the links were built.
What changed and event timeline
Muse launches
Meta released Muse, a personal AI agent, in the US on iOS, Android, the web and WhatsApp. Coverage gives different launch dates: September 8 () and September 9 ().
Claroc confirms access and reports it
Claroc opened share pages without an account, then reported the issue to Meta's bug bounty program on October 8 ().
GhostShares published
Claroc published its research, calling the findable links "GhostShares," and updated the post on October 20 ().
Ars reports and Meta pauses sharing
After Ars Technica asked about the findings, Meta suspended the feature. A Muse spokesperson said Meta would consider changes to how the links can be discovered (;).
Recheck shows links dead
Claroc retested 40 shares that had opened without login earlier in October. None opened, and the hostnames returned errors ().
Capabilities and access
- Muse runs on Meta's Muse Spark model.
- Each user's agent runs in its own cloud computer called Muse Secure VM.
- There is a free tier and paid plans at $20 and $100 a month (TechRepublic).
Read the full section
- Muse runs on Meta's Muse Spark model. It can send emails, book travel, fill in forms and make purchases, and it keeps working after the app is closed (TechRepublic).
- Each user's agent runs in its own cloud computer called Muse Secure VM. A separate "Sentinel" agent checks anything sent out to the internet (TechRepublic).
- There is a free tier and paid plans at $20 and $100 a month (TechRepublic).
- Shared items are "artifacts" that anyone with the link can open (The Verge). Meta's Help Center says shared links do not expire (Unite.AI).
Technical analysis for researchers and developers
- Each share got its own subdomain, built from a short title slug plus a random ID, under
cf.metaaiusercontent.com. - Opening a share sends a DNS lookup for that hostname, and passive-DNS sensors record those lookups.
- Claroc queried one passive-DNS provider and filtered out noise from wildcard-DNS scans.
Read the full section
- Link design. Each share got its own subdomain, built from a short title slug plus a random ID, under
cf.metaaiusercontent.com. Coverage gives examples in this pattern, such ashome-sale-budget-9f21c8a3…(GIGAZINE). - How it leaked. Opening a share sends a DNS lookup for that hostname, and passive-DNS sensors record those lookups. Because the hostname holds both the title and the ID, a DNS record is enough to rebuild the full link (The Verge). A long random ID does not help once it sits in a public log.
- Method. Claroc queried one passive-DNS provider and filtered out noise from wildcard-DNS scans. It did no guessing or brute-forcing, used an ordinary browser and did not log in (Claroc).
- Second channel. More than 75 Muse share pages were also saved on the public scanning site urlscan.io (Unite.AI).
- Design lesson. Secrets belong in the URL path or behind authentication, not in hostnames, which get logged as DNS traffic.
Claims and evidence
Read the full section
- More than 6,800 exposed hostnames; a few hundred opened. This comes from Claroc, the party that found the flaw. No other group has published a replication (Claroc).
- Sensitive content, including notes for a call with a leader at a frontier AI lab. Also Claroc's account. It withheld all identifiers (Claroc).
- No evidence that anyone misused the data. Claroc's statement, as reported by GIGAZINE.
- Feature paused. Meta's own statement (The Verge). Claroc's dead-link recheck is consistent with it.
- Muse was "built from the ground up for privacy and security." Mark Zuckerberg's claim, quoted in the Slashdot summary of Ars.
Context and prior work
Read the full section
- ChatGPT, 2025. OpenAI removed its opt-in "Make this chat discoverable" option after shared chats appeared in Google results. Its CISO, Dane Stuckey, said the feature gave people too many ways to share things by accident (Malwarebytes).
- Grok. Google indexed more than 370,000 shared Grok conversations (Unite.AI).
- Claude shared chats have also surfaced in search (The Verge).
- The difference here. Those cases ran through search crawlers. Muse leaked through DNS infrastructure, so blocking crawlers would not have stopped it.
Limitations, safety and contested findings
- Claroc used one discovery method over a short period. It says its count is not a full measure of how much was exposed (Claroc).
- The two Muse launch dates in coverage (September 8 vs. 9) have not been reconciled.
- Muse already faced separate complaints before this.
Read the full section
- Claroc used one discovery method over a short period. It says its count is not a full measure of how much was exposed (Claroc).
- The two Muse launch dates in coverage (September 8 vs. 9) have not been reconciled.
- Muse already faced separate complaints before this. Reports said it exposed its internal file system and built profiles of people who had not agreed to it (Implicator).
- Claroc reported the flaw on October 8, but sharing was suspended only on October 20, after a journalist asked about it (Unite.AI).
Business and practitioner implications
- Treat shared AI links as public. Check what staff have shared from agents connected to business email or finance tools.
- For builders: keep per-share data out of subdomains. Use authenticated or expiring shares and descriptive-free IDs, and check passive-DNS and urlscan exposure before launch.
- For buyers: do not take launch claims of "built for privacy" as proof.
Read the full section
- Treat shared AI links as public. Links that never expire and open without login can end up in DNS logs, scanner archives and search indexes. Check what staff have shared from agents connected to business email or finance tools.
- For builders: keep per-share data out of subdomains. Use authenticated or expiring shares and descriptive-free IDs, and check passive-DNS and urlscan exposure before launch.
- For buyers: do not take launch claims of "built for privacy" as proof. Ask vendors to explain their sharing design and how fast they act on bug reports.
The source trail.
Sources (9)
Meta pauses Muse sharing after researchers find AI chats on the web
Article text retrieved; extracted text may omit tables or interactive elements.
theverge.com