Meta pauses Muse AI agent's conversation sharing after Claroc found more than 6,800 shared-chat pages discoverable through passive DNS, some holding confidential business and personal details, because each share's web address carried the chat title
Security firm Claroc reported on 18 October 2026 that shared conversations from Meta's Muse personal AI agent (launched 8 September) could be found and opened by people who were never sent the link. Muse publishes a shared chat as a public page under cf.metaaiusercontent.com and builds the hostname from the conversation's title plus a random ID. The first time anyone opens a share, the full hostname is resolved through DNS, and commercial passive-DNS services record it, so the random ID offers no protection once looked up. One passive-DNS query returned more than 6,800 share hostnames, readable by title, and pages opened without an account or sign-in; urlscan.io also held more than 75 saved scans of Muse share pages. Opening a few hundred, Claroc found mostly harmless material but also dozens of personal records and internal business documents, including a job candidate's notes for a confidential executive-search call with a frontier AI lab (naming the internal contact and meeting time), a bank fraud alert with a partial account number, a real-estate investor's internal return and mortgage figures, and a staff leave calendar. Muse's robots.txt keeps search and AI crawlers off share pages, but that does not stop direct access. After Ars Technica contacted Meta, Meta told it on 20 October that it has paused the sharing feature while it reviews the report; Claroc says 40 shares it rechecked that day no longer opened, but the hostnames, titles included, remain in passive-DNS history. Primary: Claroc; wire: Ars Technica (20 Oct).
- Product
- Meta Muse (personal AI agent) conversation sharing
- Versions
- Muse share links created from launch (8 Sep 2026) until Meta paused sharing on 20 Oct 2026
- Exploited in Australia?
- unknown
- Patch to
- Treat any Muse (or other AI assistant) share link as a public web page: delete shares that held work or personal data, and assume their titles stay visible in passive-DNS records. Rotate any password, key or account detail that was pasted into a shared chat. Organisations should set an AI-use rule that business documents are not shared through consumer AI share links, and check whether staff use Muse with work accounts.
Primary: Claroc — GhostShares: a shared Muse chat exposed prep for a confidential call with a frontier AI lab leader (18 Oct 2026; updated 20 Oct) · Ars Technica — Meta Muse exposes users' personal and business secrets when they share conversations (20 Oct 2026)