Meta Pauses Muse Chat Sharing After Researchers Find 6,800 Shared Links Exposed Through DNS
Security firm Claroc found more than 6,800 Muse share links enumerable through public DNS records, including loan applications and confidential business documents, and Meta has suspended the feature while it reviews the report
By Icarus4 min read
Meta Pauses Muse Chat Sharing After Researchers Find 6,800 Shared Links Exposed Through DNS
Security firm Claroc found shared Muse conversations enumerable through public DNS records, with conversation titles readable before a single link was opened.
Meta has paused the conversation-sharing feature in its Muse assistant after security researchers showed that thousands of shared chats could be found and opened by anyone through public DNS records. In a statement to The Verge, Muse spokesperson Tracy Clayton said the company has “paused this functionality while we review this report and consider changes to how these links can be discovered.”
The research comes from Claroc, a security firm that studies how employees share data through SaaS and AI apps. In a writeup published October 20, Claroc describes how Muse’s share-by-link design put each conversation’s title directly into its web address. When you ask Muse to share a conversation, it publishes the chat as a page and hands you a link; that page opens for anyone with the link, no login required. But the link’s hostname is built from the conversation’s own title plus a random ID, served under the domain cf.metaaiusercontent.com, and every hostname lookup is written into public DNS records.
One query, 6,800 links
A month after Muse’s September launch, Claroc searched a commercial passive-DNS service (which indexes the domains its resolvers observe) for hostnames under the share domain. After filtering out scanning noise, more than 6,800 share hostnames remained, each readable by name. The researchers opened a few hundred. Almost every share they sampled opened right away in an ordinary browser, with no account needed.
Most were harmless, Claroc says: small-business sites, listings, event calendars. A minority were sensitive, and the firm describes several without naming them or linking to them: a candidate’s prep notes for a confidential call with a frontier AI lab, including the lab’s internal contact and the meeting time; a marketing company’s internal revenue review marked for its CEO; a small-business owner’s loan application with the amount requested; a to-do list containing a bank fraud alert with a partial account number; a real-estate investor’s performance report with property addresses and financial figures; and a workplace’s full-year staff vacation calendar.
The exposure extended beyond DNS. Claroc notes that urlscan.io, a public URL-scanning service anyone can query, already holds more than 75 saved scans of Muse share pages. Each address contains a random ID meant to make it unguessable, but Claroc points out that guessing was never the point. The first time anyone opens a share, DNS logs the whole hostname, random ID included, so the unguessable part gets published along with everything else.
Claroc opened sensitive shares — including a confidential call-prep briefing — in a logged-out browser window with no Meta account. Identifying labels were blacked out by the firm. Credit: Claroc.
Disclosed to Meta, now suspended
Claroc reported the findings to Meta’s bug bounty program on October 8, with reproduction steps and example shares. When the firm rechecked 40 shares on October 20 that had previously opened without an account, none opened anymore, and the hostnames serving them returned errors. The titles remain in passive-DNS history, though.
Link-based AI sharing has leaked more than intended before. In 2025, shared ChatGPT conversations surfaced in Google results, and OpenAI pulled the option that made them indexable; weeks later, Google had indexed more than 370,000 Grok conversations. Muse’s robots.txt asked search and AI crawlers to stay off the share paths, but as Claroc puts it, robots.txt controls whether crawlers may visit; it cannot keep anyone out, and their discovery never went near a search engine.
Why it matters
The episode is a reminder that a share link is a public page, whatever the feature’s framing suggests. Muse users should take away what Claroc recommends to security teams: treat any AI assistant’s “share link” as an outbound transfer of whatever was in the conversation, and be careful what gets shared. For Meta, it is another privacy problem to fix while the assistant’s download numbers keep climbing, and one more reason enterprises are scrutinizing what Muse touches.
Claroc says it has no evidence the exposed shares were misused, and that it will delete the discovery data once Meta confirms it has what it needs.
