Meta pauses Muse chat sharing after 6,800 links turned up in public DNS
Researchers found shared Muse AI chats, some with loan applications and revenue reviews, via public DNS records. Meta has paused the feature.
The skim
- Meta has paused sharing in its Muse AI assistant after researchers found more than 6,800 shared-chat links through public DNS records.
- Some of the exposed pages held sensitive material, including a loan application, an internal revenue review and a staff vacation calendar.
- The cause: each share's web address included the conversation's title, and DNS logs made those addresses easy to find.
What happened
Security firm Claroc published research, which it calls "GhostShares," showing that conversations people shared from Meta's Muse assistant could be found by anyone, without ever being sent the link. After Ars Technica asked Meta about it, the company paused the feature. A Muse spokesperson told The Verge that Meta is reviewing the report and considering changes to how the links can be discovered.
How the links leaked
Sharing a Muse conversation creates a page that opens for anyone with the link, no login needed. That's by design. The problem is how the address is built. According to Claroc, each share got its own hostname made from the conversation's title plus a random ID, served from a Meta content domain.
The random ID was meant to make links impossible to guess. But when someone opens a shared page, their browser looks up that hostname, and passive-DNS services record those lookups and keep them searchable. One query against such a dataset returned the full addresses, IDs and all, with titles that often gave away what was inside. Claroc says that after filtering out noise, more than 6,800 share hostnames were left. The researchers opened only a few hundred.
Most were harmless, things like small-business pages and event listings. A minority weren't. Claroc describes a small-business loan application, a marketing company's internal revenue review meant for its CEO, a workplace's full-year staff vacation calendar, and a job candidate's notes for a confidential call with a frontier AI lab. The firm says it reported the issue to Meta's bug bounty program on October 8. When it rechecked a sample of shares on October 20, none opened. The hostnames themselves remain in passive-DNS history, though.
Why it matters
This is a new twist on a familiar problem. Shared chats from ChatGPT, Claude and Grok have all ended up in search results before. Muse even asks search crawlers to stay away from its share pages. But blocking crawlers does nothing about DNS, and putting a human-readable title in a hostname turns a private-ish link into a searchable index entry.
The practical lesson for anyone using an AI assistant at work: treat a "share link" as publishing. If a conversation holds anything you wouldn't post publicly, don't share it by link. Security teams may want to check whether staff are creating public AI share pages at all.
