Felix Laurent
meta has paused conversation sharing in muse, its personal ai agent, after security firm claroc found more than 6,800 shared chats with a single passive-dns search. muse built each share’s web address out of the conversation’s title, and public dns records kept those addresses searchable for anyone. we read claroc’s research: pages it opened without a login included a small-business loan application, a bank fraud alert with a partial account number and a revenue review marked for a company’s ceo.
what claroc found
claroc published the research, which it calls ghostshares, on october 18. about a month after muse launched on september 8, the team searched one commercial passive-dns service for hostnames under cf.metaaiusercontent.com, the domain muse serves shared conversations from. after filtering out wildcard-dns scan noise, more than 6,800 share hostnames remained, each one a separate shared chat.
claroc opened only a few hundred of them. almost every share that was still live opened in an incognito window, with no account and no sign-in screen. the firm says gathering the list took one query. the same pages also show up elsewhere: urlscan.io, a public url-scanning service, already held more than 75 saved scans of muse share pages.
claroc says most of what it opened was harmless – small-business sites, listings, event calendars. it described six sensitive pages by category only:
- notes from a candidate preparing for a confidential executive-search call with a frontier ai lab, with the lab’s internal contact and the meeting time
- a national marketing company’s internal revenue review, marked for its ceo
- a small-business owner’s loan application, with the amount requested
- a to-do list with a bank fraud alert, a partial account number, a transaction amount and time
- a real-estate investor’s performance report with two property addresses and return, income and mortgage figures
- a workplace’s full-year staff vacation calendar, with dozens of employees
claroc says both companies are real, checked against public sources. it did not contact the people or companies involved.
how a share link ends up in dns
a muse share address has three parts: the conversation’s title, a random id and the content domain. claroc’s illustrative example, with a made-up title and id: q3-revenue-review-7b1e42f0.cf.metaaiusercontent.com.
the random id is long enough that nobody could guess it. guessing was never needed. the first time anyone opens a share, their browser resolves the hostname, and a passive-dns provider that sees the lookup records it – title and id included. since the link carries the same title and id, a hostname pulled from dns is enough to rebuild the full link.
muse does block search crawlers from share paths in its robots.txt, the standard fix after shared chatgpt conversations surfaced in google in 2025 and more than 370,000 grok conversations were indexed. robots.txt governs crawling, not access, and claroc’s discovery never touched a search engine.
what meta said
claroc reported the issue to meta’s bug bounty program on october 8, with reproduction steps and example shares. ten days later it published the research. on october 20, after ars technica asked about it, meta told the outlet it had paused the feature while it reviews the report and considers changes to how share links can be discovered. the same day, claroc rechecked 40 shares that had opened without an account earlier in the month. none opened, and the hostnames serving them returned an error.
muse ships with privacy controls meta documents in detail: an isolated cloud virtual machine per user and a credentials store that keeps passwords away from the model. claroc points out that how a share’s address is built appears in none of the sharing controls, so a settings review would not catch it. the app is not small: sensor tower counted 2.5 million daily users on october 16.
what is still missing
the pause stops new links, not old records. the hostnames, titles included, are still in passive-dns history, claroc says. on the last day it looked before the pause, muse was still minting new share hostnames – 27 that day.
meta has not said how long sharing will stay off or how it will change the link format. claroc says it has no evidence anyone misused the shares, but it also cannot tell how long any page was reachable or whether someone found it first. its search covered one discovery channel and one hostname pattern over a short window, so 6,800 is not a measure of muse’s total exposure.
