Imagine asking your AI assistant to share one conversation with one trusted person — and finding out that the link quietly listed itself, by name, in a public index anyone can search. That is what security researchers say happened inside Muse, Meta's new personal AI agent. In a report published by Ars Technica on October 20, 2026, researchers from the security firm Claroc revealed they needed exactly one search query to pull up more than 6,800 Muse conversations that users had shared by link — and when they opened a few hundred of them, they found loan applications, a revenue review marked for a CEO's eyes only, a bank fraud alert, and a candidate's confidential prep for a call with a frontier AI lab. Meta has now suspended the sharing feature. But the names of those conversations are still sitting in public records.
The timing makes the story sting. Muse launched on September 8, 2026, and Meta CEO Mark Zuckerberg said just last month that it was "built from the ground up for privacy and security." Six weeks later, the product's most basic sharing tool has been switched off because the way it built its links made private conversations findable by strangers who were never sent them.
Key Takeaways
- Security firm Claroc found more than 6,800 Muse share links with a single passive-DNS query, because Muse builds each share's web address out of the conversation's own title — so the titles themselves became a searchable public list.
- Inside a sample of a few hundred opened pages, researchers found a small-business loan application with the amount requested, an internal revenue review marked for a CEO, a to-do note flagging a bank fraud alert with a partial account number, a real-estate investor's report with property addresses and exact mortgage figures, a full-year staff vacation calendar, and confidential prep for an executive-search call with a frontier AI lab.
- The pages opened for anyone, with no account and no sign-in — Claroc calls them "GhostShares": pages strangers can find and open without ever being handed the link.
- After Ars Technica asked Meta about the research, Meta said it is suspending the sharing feature. Claroc rechecked 40 shares on October 20 and none opened — but the hostnames, titles included, remain in passive-DNS history.
- Claroc reported the issue to Meta's bug bounty program on October 8 and says it has no evidence anyone misused the shares. The lesson reaches beyond Muse: any AI "share link" should be treated as a public page.
What Happened: One Query, 6,800 Conversations
Sharing in Muse works the way it works almost everywhere else. You ask the assistant to share a conversation, it publishes the chat as a web page, and it hands you a link to send to whoever you choose. Meta's own help page describes the model plainly: people with the link can see the conversation, the link doesn't expire, and people can share the link onward. There is no login wall and no access request — having the link is the whole key.
Normally, that design leans on one protection: the link contains a long random ID that nobody could guess. Claroc's finding is that guessing was never necessary. Muse names each share's web address after the conversation itself — the title first, then the random ID, served from Meta's content domain, cf.metaaiusercontent.com. An address for a chat about selling a house reads like a label: the words "home sale budget," a short random string, and the shared domain. The title — the most revealing part — travels in plain text, in the address itself.
That is where the internet's plumbing did the rest. Every time a recipient opens a share link, their browser has to look up that address, and passive-DNS services — commercial databases that record domain lookups — store the full hostname, random ID and all. So Claroc searched one passive-DNS dataset for Muse's content domain, filtered out the noise, and was left with more than 6,800 share hostnames, each one readable by name, like a table of contents of other people's conversations. "If you had asked us beforehand, we would have guessed that gathering these would take real effort," the researchers wrote. "It took one query." And DNS was not the only shelf they were sitting on: urlscan.io, a public URL-scanning service anyone can query, already held more than 75 saved scans of Muse share pages.
What Was Inside the Exposed Pages
Claroc opened only a few hundred of the 6,800 pages and stopped. Most were harmless — small-business sites, listings, event calendars, the kind of page whose owner probably wanted it seen. A minority were not. The researchers listed six, by category only, withholding every name and link:
- A candidate's notes preparing for a confidential executive-search call with a frontier AI lab — naming the lab's internal contact and the exact time of the meeting.
- A national marketing company's internal revenue review, marked for its CEO.
- A small-business owner's loan application, with the amount requested.
- A to-do list that included a bank fraud alert, with a partial account number and a transaction amount and time.
- A real-estate investor's internal performance report, with two property addresses and exact return, income and mortgage figures.
- A workplace's full-year staff vacation calendar, listing dozens of employees against the week each one would be away.
Read that list the way a criminal would. A vacation calendar is a burglary schedule. A fraud alert with a partial account number is raw material for a convincing phone scam. A confidential meeting between a candidate and an AI lab is exactly the kind of "private fact built out of public parts" that fuels impersonation and social engineering. Claroc makes the same point: none of these people did anything exotic. They asked their assistant to share something — with one person, for one reason — and the assistant did what it was asked. The failure was in what the link itself revealed, and nobody sharing a chat could see that from inside the app.
Meta's Response: The Feature Is Suspended — But the Names Remain
Claroc says it reported the problem to Meta's bug bounty program on October 8, 2026, with reproduction steps and example shares, and made its content checks on October 7 and 8. Ars Technica reported the research on October 20 — and the response, when it came, was fast. After Ars asked Meta about it, Meta told Ars it is suspending the sharing feature. Claroc updated its report the same day: "we are glad to see it closed this quickly." When the researchers rechecked 40 shares on October 20 that had opened without an account earlier this month, none of them opened, and the hostnames serving their content returned an error.
That is a genuinely quick shutdown, and it matters. But it comes with a footnote US users should understand: the pages are closed, while the listing of their names is not. The hostnames — titles included — are still in passive-DNS history, because those records belong to third-party databases Meta doesn't control. Anyone who already pulled the list knows which conversations existed and what they were called, even if they can no longer open them. And while the feature was live, it kept producing new entries: Claroc noted the share system was still minting new hostnames — 27 on the last day it looked — right up until the suspension.
The contrast with Meta's pitch is hard to miss. This is the same Muse that Meta has been expanding aggressively all autumn — including the Muse Wonder models we covered when Meta launched Muse Wonder and Muse Wonder Full — with Zuckerberg personally framing it as a privacy-first product. A month in, its share button has been pulled over a design choice that a hostname could have given away to any careful reviewer: the product put the secret's label on the outside of the envelope.
This Has Happened Before — Twice
If this story sounds familiar, it should. In 2025, shared ChatGPT conversations surfaced in Google search results, and OpenAI pulled the option that made them indexable. Weeks later, Google had indexed more than 370,000 Grok conversations. The industry lesson from that wave was supposed to be simple: keep AI share pages out of search engines. Muse did take that step — its robots.txt asks search and AI crawlers to stay off the share paths. But as Claroc points out, robots.txt governs crawling, not access, and this discovery never went near a search engine. The leak ran through DNS, a layer the 2025 fixes never touched. Each generation of this bug has hidden in a different piece of plumbing, which is why "we fixed the search problem" was never the same thing as "shared chats are private."
Scam Warning: Exposure Stories Are Phishing Season
Expect messages riding on this news: fake "Meta security" emails or texts claiming your Muse chats were leaked and urging you to "verify your account" or "secure your data" through a link. Meta does not verify accounts through links in unsolicited messages, and no legitimate alert will ask for your password or a payment. The real risk from the exposure itself is different: details like a partial account number, a meeting time or a vacation week give scammers convincing material for targeted calls and emails. If someone contacts you already knowing oddly specific facts about your business or schedule, treat that as a warning sign, not proof they are legitimate — hang up and reach the company through its official app or number.
Checklist: If You Have Ever Shared an AI Chat
You can't change how Muse built its links, and the suspended pages no longer open. But this incident is a good prompt for a five-minute cleanup that applies to every AI assistant, not just Meta's:
- Assume shared means published. In Muse, ChatGPT, Grok and most rivals, a share link opens for anyone holding it, can be forwarded, and — per Meta's own help page — doesn't expire. Share only what you would be comfortable seeing on a public page.
- Delete old share links. Go back through the AI apps you use and remove share links you created for one-off reasons. Deleting the link is the only reliable way to close a page you no longer need open.
- Keep raw financial documents out of chats altogether. A loan application, a tax form or an ID scan doesn't get safer because the chat "feels" private. If a document matters, keep your own copy somewhere that never leaves your phone — Pro Calculator Secure Vault stores photos, videos, audio, documents and private notes locally on your device with sign-in protection, and no data collected or shared with third parties, so there is no link anyone can find.
- Mind the title. This leak worked because conversation titles described their contents. Even on platforms with safer links, a title like "loan application draft" tells a story by itself. Keep titles bland for anything sensitive.
- At work, treat AI sharing as an outbound transfer. Claroc's advice to employers is blunt: find out who is already using tools like Muse — it needs no admin rollout, so staff may be sharing today — and count every AI share link as company data leaving the building.
Frequently Asked Questions
What exactly did the Claroc researchers find in Meta's Muse?
They found that Muse builds each share link's web address from the conversation's title, and that those addresses are recorded in public passive-DNS databases. One query returned more than 6,800 shared conversations listed by name. The pages opened for anyone, with no account. Claroc calls such pages "GhostShares." Ars Technica reported the research on October 20, 2026.
Were all Muse conversations exposed, or only shared ones?
Only conversations a user chose to share by link. Nothing in the research suggests private, unshared chats were reachable. The problem is narrower and, in a way, worse: the act of sharing with one person is what created the public, findable page — and the conversation's own title advertised what was inside it.
Has Meta fixed the problem?
Meta told Ars Technica it is suspending the sharing feature, and Claroc confirmed on October 20 that 40 previously open shares no longer load. However, the hostnames — including the conversation titles — remain in passive-DNS history held by third parties, and Claroc stresses it cannot tell whether anyone else found the shares first. It says it has no evidence the shares were misused.
I shared a Muse conversation with sensitive information. What should I do?
Delete the share link inside Muse if the option is available, and work on the assumption that the content may have been seen: rotate anything reusable that was in it, watch the accounts it touched, and be alert to targeted scams using its details. Going forward, keep sensitive documents off shared cloud chats entirely — a local vault such as Pro Calculator Secure Vault keeps files on your own device behind sign-in protection, with an intruder selfie feature and an incognito private browser, alongside 8 smart calculators (standard, floating, BMI, age, currency, tip, GST & VAT and loan EMI).
Is this the same as the ChatGPT and Grok sharing incidents?
It is the same family of failure with a different mechanism. In 2025, shared ChatGPT chats appeared in Google results and more than 370,000 Grok conversations were indexed. Those leaks ran through search engines; Muse even blocked crawlers with robots.txt. The Muse exposure ran through DNS records instead — a reminder that a share page can be private from Google and still be listed, by name, somewhere else.
The Bottom Line
Meta built Muse's share links with a long random ID, the standard lock — and then wrote each conversation's title on the door. One passive-DNS query turned that choice into a named list of 6,800 conversations, and a few hundred openings were enough to surface a loan application, a CEO's revenue review, a bank fraud alert and a confidential hiring call. To Meta's credit, the feature was suspended within a day of Ars Technica asking about it. But the titles remain in public DNS history, and the deeper lesson survives the fix: on every AI platform, a share link is a publication, not a private handoff. Share accordingly — and keep the documents that truly matter somewhere that never generates a link at all. Pro Calculator Secure Vault is built by ZAS — you can see more of our apps on our developer page on Google Play.
No comments:
Post a Comment