On October 20, 2026, security firm Claroc published research showing 6,800 shared Meta Muse conversation links were enumerable in public DNS by their titles, and that same day, after Ars Technica reported the findings, Meta paused Muse's chat-sharing feature. The pages opened for anyone with the link, no login needed, by design, and the share titles sitting inside the web addresses were recorded in DNS history anyone can search.
Meta's Muse reached 10M U.S. downloads in 40 days while a share-link design left 6,800 conversations findable by name. Graphic: ByteHerald, from Claroc's and Sensor Tower's findings.
"Built from the ground up for privacy and security"
When Meta CEO Mark Zuckerberg launched Muse in September, he said the agent was "built from the ground up for privacy and security," with user data and credentials living on an isolated Muse Secure VM. That claim was aimed at the right anxiety: Muse fills out forms, books appointments, and connects to email, calendar, and WhatsApp, so it needs deep access to be useful.
The privacy design the marketing described and the privacy design that mattered were different things. Muse shares a conversation by publishing it as a page at a web address built from the conversation's own title plus a random ID. The page opens for anyone with the link, no login, which is how share-by-link products work. The flaw was one layer lower: because that address is a hostname, resolving it writes the title, the ID, and the content domain into public DNS, where passive-DNS services index and keep it searchable. A review that worked from the app's documented sharing settings could never see this. The URL design appears in none of the sharing controls, Claroc found.
What 6,800 GhostShares contained
Claroc ran one search against a commercial passive-DNS service for hostnames under cf.metaaiusercontent.com, the content domain Muse serves shares from. After filtering wildcard-DNS scan noise, more than 6,800 share hostnames remained, and because each is built from the share's title, the list came back readable, like a table of contents. The researchers opened only a few hundred and left the rest. Six of the pages they described, by category only: a candidate's confidential prep for an executive-search call with a frontier AI lab, naming the lab's internal contact and the meeting time; a national marketing company's internal revenue review marked for its CEO; a small-business owner's loan application with the amount requested; a to-do list including a bank fraud alert with a partial account number plus the transaction amount and time; a real-estate investor's internal performance report with property addresses and exact return, income, and mortgage figures; and a workplace's full-year staff vacation calendar, listing dozens of employees against the week each would be away.
The researchers reached every one of these without being given its link, from a domain-lookup dataset, with no account. They told Claroc's readers the two companies are real, confirmed against public sources, and that they did not contact the people involved. The meeting in the call prep, Claroc noted, is not public even if the biography is: who is quietly talking to whom, and when. A page like that builds a private fact out of public parts and hands it to anyone who can search DNS. Claroc also reports finding no evidence that anyone had misused the shares.
There is a history here. In 2025, shared ChatGPT conversations surfaced in Google results, and Google later indexed more than 370,000 Grok conversations; keeping AI share pages out of search engines became the obvious precaution, and Muse's robots.txt does ask crawlers to stay off share paths. But robots.txt governs crawling, not access, and Claroc's discovery never went near a search engine. A mechanism review can miss what the settings do not describe: we saw the same pattern from the other side when WhatsApp's help pages hid AI-only instructions its documented controls never mentioned.
The 40-day blast radius
The leak matters in proportion to the app's scale, and Muse's scale is historic. Sensor Tower data reported by TechCrunch on October 20 puts Muse at 10.9 million downloads since its September debut, 10.2 million of them in the United States, making it one of only 12 apps ever to cross 10 million U.S. downloads in its first 40 days. The most recent previous member of that club was Meta's Threads in July 2023, and apart from Disney+, every other app to do it was a mobile game.
| App | U.S. downloads, first 40 days |
|---|---|
| Meta Muse | 10.2 million |
| ChatGPT | 3.7 million |
| Grok | 500,000 |
| Claude | 200,000 |
Compare the rivals in the same window: ChatGPT managed 3.7 million U.S. downloads in its first 40 days, Grok 500,000, Claude 200,000, all from the same Sensor Tower data. Muse also kept its users: 30% day-7 and 23% day-14 retention in the U.S. against a 19% and 16% average for rival AI apps, 2.5 million daily actives reached on October 16, and the No. 1 U.S. App Store slot held nearly every day since launch. 10 million downloads in 40 days means a vast population of users handing an agent their calendars, forms, and loan applications, and every share any of them created minted a titled hostname in DNS. Adoption this fast is what turns a design flaw into a blast radius.
Meta paused sharing, but the hostnames remain
Claroc reported the findings to Meta's bug bounty program on October 8, 2026, with reproduction steps and example shares. The company says Meta did not reply before the research went public. After Ars asked Meta about the research on October 20, Meta said it was suspending the feature, stating it had "paused this functionality while we review this report and consider changes to how these links can be discovered." When Claroc rechecked 40 shares on October 20 that had opened without an account earlier in the month, none opened, and the hostnames that serve the content returned an error. The hostnames themselves, titles included, are still in passive-DNS history.
That last detail is the judgment call Meta's redesign has to get right. Pausing the feature closes the pages; it does not erase the catalog. Anyone who searched the dataset before the change still has a list of titles, and passive-DNS history does not forget on its own. A fix that only blocks new shares leaves 6,800 titled hostnames searchable as a permanent archive of who shared what with Muse. The real question for the redesign is not whether future links expire, but whether Muse keeps minting public hostnames from private conversation titles at all.
How chatbot sharing works, and how to share safely
Every major AI chatbot shares conversations by link the same way: you tap share, the assistant publishes the conversation as a page on its servers, and anyone with the link can open it without an account. The page is public by design, so the person you send it to can open it without logging in. What varies is how discoverable that page is: whether the URL carries the conversation title, whether search engines are told to stay away, and whether the link can be deleted or expires. Muse's help documentation, in Meta's own words for its share-a-link model, says people with the link can see the conversation, the link does not expire, and it can be re-shared.
Three rules cover the safe cases. First, treat a share link as a public page, because that is what it is: assume anyone who gets it can read it, and assume re-sharing makes the link untraceable. Second, never share a conversation containing information you would not publish: names, account details, internal contacts, meeting times, business figures, calendars. Strip personal data before you share, or paste only the excerpt you want seen into a new chat. Third, delete shared links when you are done. Most AI assistants keep a list of your shared links in their settings, and deleting them is the only way to close the page. Check yours today: whatever you shared stays shared until you remove it.
For companies, the exposure has a shadow-IT dimension Claroc's report flags explicitly: Muse needs no admin rollout, so employees can create and share conversations today with nobody having approved the tool, and Muse keeps minting new share hostnames even now, 27 on the day the researchers last looked. Claroc's advice to security teams is to find out who inside the company is using Muse, tell people exactly what a share link does, and if nothing in the stack can see or govern Muse sharing, block muse.ai and metaaiusercontent.com at the proxy. Readers assessing where disclosure duties sit can check AI Regulation Worldwide: Every Law, Compared for how different jurisdictions treat this kind of data exposure.
By ByteHerald Staff. Findings from Claroc's GhostShares report, published October 20, 2026 (6,800 plus share hostnames under cf.metaaiusercontent.com, one passive-DNS query; bug bounty report to Meta October 8; no evidence of misuse). Downloads from Sensor Tower data via TechCrunch, published October 20, 2026. Zuckerberg quote from Meta's Muse launch announcement. Meta's pausing statement given to Ars Technica, October 20, 2026.
Comments
Post a Comment