Meta's Muse exposed private AI chats through public DNS records

Meta's new AI agent Muse had a simple feature that turned into a privacy problem. When a user asked Muse to share a conversation, it created a public web page and handed back a link to send to a colleague or a friend. That is normal for AI assistants. What was not normal was how Muse built that link. It placed the title of the conversation directly into the web address, and that address ended up in public DNS records that anyone can search. Security researchers at Claroc used exactly those records to find more than 6,800 shared Muse conversations without ever being sent a single link. On 20 October 2026, after Ars Technica asked about the findings, Meta said it had paused the sharing feature.

This article is based on Claroc's own research post, "GhostShares: A Shared Muse Chat Exposed Prep for a Confidential Call With a Frontier AI Lab Leader", published on 18 October and updated on 20 October, and on reporting by Ars Technica, The Verge and Engadget. Meta's statement comes from its replies to Ars Technica and The Verge. Claroc says it has no evidence that anyone misused the exposed pages.

What happened

Muse launched on 8 September 2026 as Meta's personal AI agent. It does far more than answer questions. It fills out forms, books appointments, makes purchases and writes documents, and to do that it needs access to many of a user's accounts. Mark Zuckerberg described it last month as built from the ground up for privacy and security. It climbed quickly into the top spots of Apple's App Store.

Like ChatGPT, Claude or Gemini, Muse lets you share a conversation. You ask it to share, it publishes the chat as a page, and anyone with the link can open it without logging in. Claroc stresses that this part is by design. A public page is the only way the person you send the link to can read it. The problem was that the link was not only reachable by the people it was sent to. It was also findable by strangers.

Why the links were easy to find

Every Muse share was served from one content domain, cf.metaaiusercontent.com. Each share got its own hostname under that domain, and Muse built that hostname from two parts: a short phrase describing the conversation, taken from its title, and a random ID. Claroc's illustrative example looks like home-sale-budget-9f21c8a3.cf.metaaiusercontent.com.

On paper the random ID should protect the page. Nobody can guess a long random string. But guessing was never needed. The first time anyone opens a share link, their browser has to look up the full hostname in the Domain Name System, the phone book of the internet. Many commercial services run so called passive DNS sensors that record these lookups and keep them in searchable databases. So the moment the intended recipient clicked the link, the whole hostname, title and random ID included, could land in a public index.

Claroc searched one of these commercial passive DNS datasets for the Muse content domain about a month after launch. After filtering out noise, more than 6,800 share hostnames remained. Because each hostname contained the conversation title, the list read like a table of contents. In Claroc's own words: "If you had asked us beforehand, we would have guessed that gathering these would take real effort. It took one query."

Meta had taken the obvious precaution against the leak that hit other AI chatbots in 2025. Muse's robots.txt file told search engine crawlers to stay away from share pages. But robots.txt only controls crawling. It does not control access, and Claroc's discovery never went near a search engine. The researchers also found more than 75 saved scans of Muse share pages on urlscan.io, a public URL scanning service that anyone can query.

What the exposed pages contained

Claroc opened only a few hundred of the 6,800 shares and left the rest alone. Most were harmless: small business pages, listings and event calendars that their owners probably wanted people to see. A minority were clearly sensitive. Without giving names or links, Claroc described six examples:

• a candidate's notes for a confidential executive search call with a frontier AI lab, including the lab's internal contact and the time of the meeting
• a national marketing company's internal revenue review, marked for its CEO
• a small business owner's loan application, with the amount requested
• a to do list that included a bank fraud alert with a partial account number, a transaction amount and a time
• a real estate investor's performance report with two property addresses and exact return, income and mortgage figures
• a workplace's full year staff vacation calendar, listing dozens of employees and the week each one would be away

Every one of these pages opened in a logged out browser, with no Meta account. Claroc did not contact the people or companies involved, but says the two companies are real and that it confirmed this against public sources.

The executive search notes show why this is worse than it sounds. The biography in such a document might already be public. The meeting is not. Who is quietly talking to whom, and when, is exactly the kind of information that fraudsters and social engineers look for. A vacation calendar tells an attacker which employees are away and when an impersonation email might not be questioned. A fraud alert with partial account details is a starting point for a convincing phishing call.

How Meta responded

Claroc says it reported the issue through Meta's bug bounty program on 8 October 2026, with reproduction steps and example shares, and also tried to reach people at Meta on LinkedIn. According to Claroc's CTO Asaf Aprozper, it got no reply either way. The research went public on 18 October. On 20 October Ars Technica asked Meta about it, and Meta answered the same day:

"We opened the Muse bug bounty program so researchers could raise different scenarios and help us continue improving the product. People have the ability to share specific Muse artifacts, which creates a page that can be accessed by those with the link. However, we've paused this functionality while we review this report and consider changes to how these links can be discovered."

Muse spokesperson Tracy Clayton gave The Verge the same statement. Claroc then rechecked 40 shares that had opened without an account earlier in October. None of them opened anymore, and the hostnames serving their content returned an error. That is good news for affected users. But the hostnames themselves, titles included, are still sitting in passive DNS history. A title like "loan application draft" or "q3 revenue review" can leak information on its own, even when the page behind it is gone.

Not the first AI sharing leak, but a new kind

Shared AI conversations have leaked before. In 2025, shared ChatGPT conversations showed up in Google search results, and OpenAI removed the option that made them indexable. Weeks later, Google had indexed more than 370,000 Grok conversations, according to Claroc's summary. Those cases were about search engines. The Muse case is different, and in one way more uncomfortable: it did not need a search engine at all. It used a basic part of how the internet works. Any service that puts meaningful text into a hostname, and then serves private content behind it, is exposed in the same way.

It is also not Muse's first security story. Three weeks after launch, macOS security researcher Patrick Wardle found a zero day flaw that let another app on the same Mac take over a user's Muse account, as Ars Technica reported. Meta played down that bug because the device would already have to be compromised. Taken together, the two findings raise a fair question for a product that asks for access to email, calendars, payments and documents: is the security work keeping pace with the access?

Why it matters

AI agents are moving from chat windows into real work. They read our inboxes, draft our contracts and act on our behalf. That means the things people type into them are often more sensitive than a normal search query. A share button looks harmless, and most people assume a link with a random code in it is private. This case shows that the design details matter: where a title is placed, which domain serves the content and what gets logged along the way. None of that is visible to the user who taps Share.

For companies, Claroc makes a sharp point. A security review that only looks at an app's settings can miss this entirely. Each share is one employee's request, made after the tool was approved, and nothing in the sharing controls reveals that the link will end up in public DNS. Muse also needs no admin rollout, so staff may be using it without the security team knowing.

What you should do now

If you use Muse or any other AI assistant, treat every share link as public, no matter how random it looks. Keep names, numbers and plans out of conversation titles. Review your old shares and delete the ones you no longer need, and share a finished document instead of a whole conversation when you can.

If you work in security, Claroc's advice is practical. Find out who in your company already uses muse.ai. Add share links to your AI usage rules and explain what they really do. Treat the creation of an AI share link as an outbound transfer of whatever was in the conversation. If you cannot see or govern Muse sharing at all, consider blocking muse.ai and metaaiusercontent.com on managed devices until you can. And check your own exposure the same way the researchers did: search passive DNS and urlscan for the content domains of the AI and SaaS tools your staff use, and create a test share to see what lands in the address.

Dany's take

I like that Meta reacted fast once a journalist asked. I like less that, according to Claroc, a bug bounty report sat for twelve days without an answer. The technical mistake is small and easy to fix: keep the title out of the hostname, put the secret in the path, and make shares expire. The bigger lesson is about trust. Agents like Muse only work if we hand them the keys to our digital lives. In return, the companies building them need to think about every place our data can leak, including the boring plumbing of the internet. Until that is proven, I would treat any AI share link like a postcard: anyone along the way might read it.

Sources: Claroc research blog, Ars Technica, The Verge, Engadget.