Meta paused Muse sharing after researchers found more than 6,800 shared chats through DNS records

Meta has paused the feature that lets Muse users share a conversation by link, after the security firm Claroc showed that those links could be found without anyone sending them. Claroc says a single passive DNS search returned more than 6,800 share addresses. The few hundred pages it opened included loan applications and internal company reports. Meta announced the pause in a statement to Ars Technica on October 20, 2026.

How a shared link became searchable

Muse is the personal AI agent Meta launched on September 8, 2026. It fills out forms, sends messages, and makes purchases on the user's behalf, so it holds access to a large part of that person's accounts.

A shared Muse conversation is a web page that anyone with the link can open, with no login. That is by design, since a link is the only way to share. Each address also contains a long random ID, so nobody can guess it.

The problem, according to Claroc, was the rest of the address. Each share got its own hostname, built from the conversation's title and the random ID, under the content domain cf.metaaiusercontent.com. A title such as a home-sale budget told anyone what the page held before it was opened.

Passive DNS services did the rest. They record the hostnames their resolvers look up and keep those records searchable. The first time anyone opened a share, its full hostname, random ID included, ended up in those records. Claroc says one search for the Muse domain returned the list, and that the public scanning service urlscan.io held more than 75 saved scans of Muse share pages as well.

Muse's robots.txt file asks search engines to stay off share pages. Claroc says this became the standard precaution after shared ChatGPT and Grok conversations surfaced in Google results in 2025. The rule governs crawling, not access, and Claroc's method never involved a search engine.

What the pages contained

Claroc says it opened only a few hundred of the hostnames, in a browser with no Meta account. Most pages were harmless: small-business sites, listings, and event calendars. The firm says it has no evidence that anyone misused the shares, but it cannot tell how long any page was reachable or whether someone found it first.

A minority of the pages held sensitive personal or business data. Claroc lists six of them by category only, without names or links:

• a candidate's notes for a confidential executive-search call with a frontier AI lab, naming the lab's contact and the meeting time
• a national marketing company's internal revenue review, marked for its CEO
• a small-business owner's loan application, with the amount requested
• a to-do list with a bank fraud alert, a partial account number, and a transaction amount and time
• a real-estate investor's internal report, with two property addresses and exact return, income, and mortgage figures
• a workplace's full-year vacation calendar, listing dozens of employees and the week each one is away

What Meta did, and what is left

Claroc reported the findings through Meta's bug bounty program on October 8, 2026. Asaf Aprozper, the firm's co-founder and CTO, told Ars Technica that he got no reply there or on LinkedIn.

After Ars Technica asked about the research, Meta said it had paused sharing while it reviews the report and considers changes to how these links can be discovered. Claroc says that on October 20 it rechecked 40 shares that had opened without an account earlier in the month, and none of them opened.

The pause does not remove what has already been recorded. Claroc notes that the hostnames, titles included, are still in passive DNS history. Meta's statement does not say whether sharing will return, or in what form.

Claroc also addresses companies. Muse needs no administrator rollout, so employees can use it and share from it without anyone approving the tool. The firm advises security teams to find out who uses Muse and, where they cannot monitor sharing, to block muse.ai and metaaiusercontent.com on managed devices. Claroc sells a product that monitors this kind of sharing, so the advice comes from an interested party.