Meta pauses Muse conversation sharing after researchers find 6,800 shared chats via DNS

Meta has paused the conversation-sharing feature in Muse, its AI agent, after security firm Claroc reported that shared chats could be found by anyone searching public DNS records. Claroc says it enumerated more than 6,800 share links, and opened a few hundred of them.

The cause was how the links were built. Each share used the domain cf.metaaiusercontent.com, with a short title describing the conversation and a random ID placed in the subdomain rather than in the URL path. Claroc says that because DNS records capture hostnames, a hostname pulled from passive DNS data rebuilds the full link.

Content Claroc found included a marketing company's revenue review, a small business owner's loan application, a workplace's full-year staff calendar, and notes for a job candidate's call with an AI lab. Claroc calls such pages GhostShares.

Meta spokesperson Tracy Clayton said in a statement that users can share Muse artifacts, creating a page accessible to anyone with the link, but that the company has paused the function while it reviews the report. Claroc co-founder and CTO Asaf Aprozper said he reported the findings through Meta's bug bounty program on October 8 and tried contacting Meta staff on LinkedIn, without a reply.

Muse has grown quickly. Sensor Tower data reported by TechCrunch shows 10.9 million downloads in its first 40 days, and retention above rival AI apps. Because the assistant fills out forms, books appointments and makes purchases, it needs broad access to users' accounts, which raises the stakes of any leak.

The finding follows another security report. Ars Technica says researcher Patrick Wardle found a zero-day three weeks after launch that let another app on the same device take over a Muse account. Meta played down its severity, arguing the device would already have to be compromised. Ars argues the latest issue sharpens questions about whether Muse merits the trust it asks for.

Public share links are a recurring weak point for AI products. Chats from ChatGPT, Claude and Grok have previously surfaced in Google Search. Here the exposure came through DNS rather than search indexing, but the effect was the same: pages meant for a chosen recipient were findable by strangers.

Meta has said only that it is considering changes to how links can be discovered. Whether it restores sharing, and whether it removes titles from hostnames or restricts access in another way, has not been announced.

It is also unclear whether Meta will expire or disable links already created, and whether it will address the reporting delay Claroc describes in its bug bounty handling.