One passive-DNS query surfaced roughly 6,800 shared Meta Muse conversation links, some containing confidential files exposed to unintended audiences, including business notes, loan applications, and partial bank-account details. Security firm Claroc published those findings on October 18, exposing a structural problem with how Muse handled its link-sharing feature: “anyone with the link” turned out to mean considerably more people than you probably intended.
Muse is Meta’s general-purpose AI agent, capable of searching the web, filling out forms, booking appointments, and connecting to your accounts. That scope matters here, because this is not a note-taking app; it is a system with access to your calendar, professional correspondence, and connected services.
Why the Link Wasn’t as Private as It Looked
Many services use opaque identifiers in share links, but Muse reportedly placed descriptive conversation titles inside the hostname itself, where network infrastructure could record them.
According to Claroc’s research, Muse’s sharing feature placed the conversation title directly inside the subdomain of the sharing address, producing hostnames like q3-revenue-review-7b1e42f0.cf.metaaiusercontent.com. Every time a webpage loads, the internet’s address-lookup system logs which hostname was requested.
Passive-DNS providers retain those historical observations, making hostnames associated with a domain searchable long after the original request. Claroc called the resulting discoverable pages “GhostShares“: shared links that could be found by people who never received them directly.
Conversation titles alone, before a page even opens, revealed sensitive subjects.
What Researchers Found
After querying passive-DNS records, Claroc opened several hundred pages and found sensitive personal and business information across multiple categories.
Claroc reported encountering confidential executive-search preparation notes and an internal company revenue review, according to Claroc’s published research and Ars Technica’s reporting on October 20. That list also included a small-business loan application, a bank-fraud alert containing partial account information, a real-estate investment report, and an employee vacation calendar, per the same sources.
The researchers did not report guessing a random string or exploiting a vulnerability in Muse’s private sessions. Claroc reportedly searched records associated with Meta’s content-delivery domain, retrieved the descriptive hostnames, and opened the pages from there.
Meta’s Response and What It Means for You
Meta paused the sharing feature after Claroc reported the issue, but the episode raises broader questions about how AI agents handle each individual data path.
Meta told Ars Technica that Muse sharing creates pages accessible to people who have the link, and that it paused the feature while reviewing the report and considering changes to how the links can be discovered. Claroc had reported the findings through Meta’s bug-bounty program on October 8, ten days before publishing its research publicly.
This is not evidence that every private Muse conversation leaked. The risk applied specifically to conversations users had deliberately shared through the feature, while unintended discoverability was the reported problem. Private sessions operated separately, according to Meta’s documentation describing isolated cloud environments.
Muse is built to sit across your entire digital life, and that reach creates multiple data paths: private sessions, sharing features, connected-account integrations, and more. Think of it like a smart thermostat that also controls your front-door camera. The device itself may be secure, but each integration deserves its own scrutiny.
Treat any AI share link as potentially discoverable by secretly tracking users and infrastructure outside your control. Delete shared pages when the conversation has served its purpose, where deletion controls are available, and evaluate each sharing or integration feature on its own terms to stay safe. Your assistant’s general privacy posture does not automatically extend to every button you click inside it.
