Meta suspended the conversation-sharing feature of Muse, its personal AI agent, on October 20, 2026, after Ars Technica asked the company about research from security firm Claroc. Claroc said it had found more than 6,800 Muse share pages through a single passive-DNS query, because Muse put each conversation's title into the web address of the page. A sample of a few hundred opened without a login, and a minority held loan details, internal revenue figures and a staff absence calendar.

In Short

When people asked Muse to share a chat, Meta's assistant turned it into a public web page whose address included the chat's title. Those addresses ended up in public lists of looked-up domain names, so a security company could find thousands of them without ever being sent a link, and some held private business and money details. Meta has switched the sharing feature off while it reviews the problem, but the names of the old pages are still sitting in those lists.

Who found it, and who reported it

The original research comes from Claroc, a company that sells security teams visibility into the SaaS and AI apps their staff use. Its research team published the findings on its blog under the title "GhostShares: A Shared Muse Chat Exposed Prep for a Confidential Call With a Frontier AI Lab Leader". The post carries a date of October 18, 2026, and an update dated October 20, 2026. Ars Technica's report, by senior security editor Dan Goodin, appeared on October 20 at 14:33 and says the researchers "reported Monday", which would be October 19; the two dates do not match, and neither source explains the gap. Futurism (Joe Wilkins, October 20, 4:25 PM EDT) and the New York Post (Ben Cost, October 21, 10:08 a.m. ET) both credit Ars Technica and link to Claroc. Neither adds new reporting on the share mechanism, though the Post says Meta's statement was also given to it.

Ars Technica is the outlet that put the findings to Meta. According to Claroc's update, Meta told Ars it was suspending the feature "after Ars asked Meta about it". According to Ars, Claroc co-founder and CTO Asaf Aprozper said he had reported the issue through Meta's bug bounty program on October 8 and had also tried to reach Meta staff on LinkedIn, "but got no reply either way."

How a Muse share became findable

Sharing in Muse worked like sharing in many chat products. A user asked Muse to share a conversation, and Muse published it as a page and returned a link. According to Claroc, the page "opens for anyone who has that link, without a login or a request for access, and that is by design". A public page was the only way the person receiving the link could open it.

The problem, by Claroc's account, sat in how the address was built. Muse served shared content from hostnames under cf.metaaiusercontent.com, and each hostname began with the share's title, followed by a random ID. Claroc describes the title as "a short phrase describing the conversation". The researchers gave made-up examples in the form home-sale-budget-9f21c8a3.cf.metaaiusercontent.com, and Ars Technica reproduced them. Ars puts the core of it this way: "It's this last design decision, putting the conversation title in the subdomain rather than in the URL path, that makes public discovery possible."

Why does that matter? A path segment after a slash travels inside the encrypted request to the server. A hostname does not stay private in the same way, because the browser must resolve it through DNS before anything else happens. Passive-DNS services record those lookups from sensors at recursive resolvers and keep them searchable. According to Claroc, "the first time anyone opens the share, DNS logs the whole hostname, random ID and all, so the part that was meant to be unguessable gets published with everything else." Since the share link carries the same title and ID, Claroc says, a hostname pulled from DNS "rebuilds the link."

The random ID itself was not weak. Claroc calls it "long enough that nobody could guess it" and says guessing was never needed. "An ID only works as a secret while it stays secret, and a hostname is not a secret."

Search engines were blocked, DNS was not

The exposure did not involve Google or any other search engine. According to Claroc, Muse's robots.txt asked search and AI crawlers to stay off the share paths. But, as the firm puts it, "robots.txt governs crawling, not access, and our discovery never went near a search engine." Claroc places Muse in a line of earlier incidents: shared ChatGPT conversations surfacing in Google results in 2025, after which OpenAI pulled the option that made them indexable, and more than 370,000 Grok conversations indexed by Google weeks later. Those figures are Claroc's, with links to Search Engine Journal and 9to5Mac respectively.

Claroc also points to a Meta help page about sharing a Meta AI conversation. That page, which Claroc notes "documents Meta AI rather than Muse specifically", says "people with the link will be able to see your conversation," that the link "doesn't expire," and that people "can share the link." Claroc calls it "the closest published description Meta gives of how one of its AI share links behaves".

The count: 6,800 hostnames, a few hundred pages

The numbers need care, because the follow-on coverage blurred them. According to Claroc, Muse launched on September 8, 2026, and about a month later the team searched a commercial passive-DNS service for hostnames under the Muse content domain. After filtering out scan noise from wildcard DNS, more than 6,800 share hostnames remained, each corresponding to one share.

Claroc opened "only a few hundred of them and left the rest." "If you had asked us beforehand, we would have guessed that gathering these would take real effort," the researchers wrote. "It took one query." The New York Post and Futurism both describe Claroc accessing pages "from over 6,800 links"; Claroc's own post says it listed that many hostnames and opened a sample.

A second public source held the same material. According to Claroc, urlscan.io, a URL-scanning service anyone can query, "already holds more than 75 saved scans of Muse share pages."

Claroc adds that the share tier "keeps minting new hostnames, 27 on the day we last looked". The post does not give that date, and Claroc describes the figure as "continued discovery, not re-verified access."

What the exposed pages held

Most of the sample was harmless, according to Claroc: "small-business sites, listings, event calendars, the kind of page whose owner likely wanted it seen." A minority were not. Claroc listed six by category only, with no names or links, and Ars Technica reprinted the list:

  • notes a job candidate prepared for a confidential executive-search call with a frontier AI lab, naming the lab's internal contact and the time of the meeting
  • an internal revenue review at a national marketing company, marked for its CEO
  • a small-business owner's loan application, including the amount requested
  • a to-do list containing a bank fraud alert, with a partial account number and a transaction amount and time
  • a real-estate investor's internal performance report, with two property addresses and exact return, income and mortgage figures
  • a workplace's full-year staff vacation calendar, listing dozens of employees against the week each would be away

The summary at the top of Claroc's post also mentions a home-sale budget. Claroc says the two companies involved "are real, confirmed against public sources", and that it did not contact any of the people or companies whose pages it read. It identifies none of them, and nor does Ars Technica.

The call-preparation page gave the post its title, and Claroc's point about it goes beyond the content itself. A candidate's biography might be assembled from public sources. The meeting was not public. In the firm's words, "A page like this builds a private fact out of public parts and hands it to anyone who can search DNS."

Headlines versus findings

Two of the follow-on reports carry headlines stronger than the research. Futurism's says Muse was "Caught Leaking Users' Intimate Personal Information". None of the six categories Claroc published involves intimate or sexual content; they are financial, employment and business records. The New York Post's headline says the flaw "leaves users vulnerable to identity theft". Claroc does say a list of such pages is "ready-made for fraud, impersonation or social engineering", but it also says: "We have no evidence that anyone has misused these shares." The Post also writes that Meta "has shut down the feature", while Meta's own statement uses the word "paused".

Futurism and the Post describe the title in the address as AI-generated. Claroc describes it once as "a short phrase describing the conversation" and later writes that "the title the user typed lands in a public index of domain names." The research does not settle whether users wrote the titles or Muse generated them, or whether that varied.

Method and limits

Claroc's description of its method is narrow. Every hostname came from one commercial passive-DNS provider; "We guessed and brute-forced nothing". Muse sent only the share's title in its first response and rendered the conversation with JavaScript, so a plain fetch returned a near-empty page, and the team loaded each page in an ordinary browser. Researchers viewed only pages that loaded on their own without an account. "We did not log in, fill in a form, or upload anything; one page asked for a password and we left it." Severity calls were made by a person reading each page, not by keyword matching.

The content checks took place during collection on October 7 and 8, 2026. Claroc says it reopened one page, the call preparation, once on October 18 to take a redacted screenshot, and opened no others after collection. The post's screenshot shows that page in a logged-out incognito window, with a share address on muse.ai and Log in and Sign up buttons visible, and with the slug, title and lab-side contact's name blacked out.

Claroc is explicit about what the work does not show. "This is one discovery channel and one hostname pattern, on one product, over a short window. It is not a measure of Muse's total exposure, and we can't tell how long any share had been reachable, or whether someone else found it first." The firm says it is withholding every hostname, title, figure and link, and that it will delete its stored discovery data "once Meta confirms it has what it needs."

Meta's response

Meta gave Ars Technica an emailed statement, which the New York Post also published:

"We opened the Muse bug bounty program so researchers could raise different scenarios and help us continue improving the product. People have the ability to share specific Muse artifacts, which creates a page that can be accessed by those with the link. However, we've paused this functionality while we review this report and consider changes to how these links can be discovered."

The statement does not say how many shares were created, whether Meta will expire or delete existing ones, whether it will notify users whose pages were reachable, or when sharing will return. It does not address the hostname design directly, beyond the reference to "how these links can be discovered". It also does not confirm the October 8 bug bounty report or respond to Aprozper's account that he received no reply.

Claroc tested the change. "When we rechecked 40 shares on October 20 that had opened without an account earlier this month, none opened for us, and the hostnames that serve their content returned an error." The firm added a caveat that the pause does not cover: "The hostnames themselves, titles included, are still in passive-DNS history." Claroc said it was "glad to see it closed this quickly." Ars concluded that "Muse users no longer face this particular threat, at least for now."

A second security finding in six weeks

Ars Technica placed the share issue next to an earlier one. According to Ars, three weeks after the Muse launch, macOS security researcher Patrick Wardle found a zero-day vulnerability that let any other app on the same device take full control of a user's Muse account. Meta played down the severity on the grounds that exploitation required an already compromised device, and, per Ars, did not acknowledge Wardle's finding that a ClickFix attack was enough to hijack an account. "The ease in discovering share links further justifies asking if Muse is worthy of the access it requires," Goodin wrote.

That access is extensive. Ars describes an assistant that "autonomously fills out forms, books appointments, makes purchases, creates documents" and "requires access to most of a user's accounts". Ars and Futurism both cite Mark Zuckerberg saying in September that Muse was "built from the ground up for privacy and security." Futurism adds that the post later carried a Community Note on X, and that earlier this month Muse was reported to keep a running "page for every person in the user's life", a claim Futurism attributes to an internal instruction and which the four sources here do not detail further.

Why this matters for marketers

Muse has moved quickly into business use. Meta released the agent in the US on September 8 through a standalone app and WhatsApp, with a design that, Meta said at the time, keeps conversations away from its ad systems and requires approval before Muse sends mail or completes a purchase. Three weeks later, Meta connected Muse to ad accounts and 15 business tools for small businesses in the US and Canada. An agent that can read an ad account, a CRM or an inbox will be asked to produce exactly the kind of documents Claroc found: revenue reviews, budgets and staff calendars. None of the approval controls Meta described governs what happens to a conversation after the user chooses to share it.

Claroc makes the corporate point directly. "Each share is a request an employee makes, one conversation at a time, and Muse carries it out as documented." A review of an app's documented settings would not catch the hostname design, because "the way its URL and hostname are built and the way DNS records them, appears in none of the sharing controls." Muse needed no admin rollout, the firm notes, so staff could start sharing work conversations before any security review. Claroc's post goes on to recommend inventorying Muse use, monitoring share creation and, if neither is possible, blocking muse.ai and metaaiusercontent.com at the network level. Those recommendations come from a vendor whose browser extension is built to detect public AI share links, and the post ends with a demo request.

There is a pattern here that PPC Land has tracked across AI chat products. In October, a study from IMDEA Networks found that six of nine AI chatbots passed chat titles or conversation links to trackers, with Gemini, Grok and Mistral leaking auto-generated conversation names, and every service tested exposing shared conversations without login. The same lesson runs through both cases: a title written to summarise a private conversation is itself private data, wherever it ends up. Earlier, a UC Davis paper found 17 of 20 popular chatbots sent data to at least one third party during a single chat.

The contrast with a competing design arrived only days before the Muse pause. DuckDuckGo's Duck.ai share links, introduced on October 7, encrypt the chat on the sender's device, put the decryption key after the # in the URL where browsers generally do not send it to servers, ask search engines not to index the page, and expire after 48 hours by default. Meta's help page for Meta AI, by Claroc's reading, describes links that do not expire.

For advertisers, Meta's handling of conversational data has a history. In October 2025, Meta said that interactions with Meta AI would feed content and ad personalisation from December 16, 2025, excluding sensitive topics. The Muse launch drew a sharper line around agent data. The share episode does not concern ad use at all; it concerns pages Meta hosted publicly at a user's request. But it adds to the list of questions merchants, agencies and in-house teams face about what a Muse conversation contains and where it can travel. For some, those questions are already practical: Amazon blocked Muse from shopping on its site in September, and DataDome found that Muse accounted for 33% of agentic browser requests on its network that month, a sign of how many agentic AI sessions now run through it.

Fraud risk is the final thread. A list of who is applying for which loan, which employees are away which week, or which account just flagged a fraud alert is raw material for targeted phishing. Claroc found no misuse, and it cannot say whether anyone else read the pages first.

What the sources do not say

Several points remain open after the four documents:

  • How many Muse shares existed in total, beyond the 6,800-plus hostnames one passive-DNS provider recorded.
  • Whether shares are being deleted or only made unreachable, and whether old links will work again when sharing returns.
  • Whether Meta will notify the users whose pages were reachable without login.
  • When sharing will return, and whether the title will be removed from the hostname.
  • Whether the Meta AI help-page terms, including links that do not expire, applied to Muse shares.
  • Whether Meta received and triaged Claroc's October 8 report before Ars Technica's inquiry.
  • Whether titles were written by users or generated by Muse.

Timeline

Summary

Who: Claroc, a SaaS and AI security vendor, did the original research; Ars Technica (Dan Goodin) put it to Meta; Futurism and the New York Post followed. Meta, which runs the Muse AI agent, responded with a statement. Affected parties are Muse users whose shared conversations were reachable, including at least two real companies Claroc did not name.

What: Muse built each share's hostname from the conversation's title plus a random ID, under cf.metaaiusercontent.com. Passive-DNS services recorded those hostnames when shares were opened, letting Claroc list more than 6,800 of them in one query. A sample of a few hundred opened without a login; a minority held loan details, internal revenue figures, a fraud alert with a partial account number and a staff vacation calendar. Meta paused sharing.

When: Claroc collected and checked pages on October 7 and 8, 2026, and reported to Meta's bug bounty program on October 8. Its post is dated October 18. Ars Technica published and Meta paused the feature on October 20, 2026. The New York Post followed on October 21.

Where: Meta's Muse, available in the US since September 8, 2026, with shares served from Meta's content domain and discovered through a commercial passive-DNS service and urlscan.io.

Why: Placing a descriptive title in a hostname made private shares findable through DNS records that are public by nature. The issue matters for businesses because Muse now has access to ad accounts and business tools, and a single employee's share can publish internal documents with no admin control in the path. The hostnames, titles included, remain in passive-DNS history after the pause.