A marketing company’s confidential files exposed , a revenue review meant for its CEO. A small-business loan application. An employee vacation calendar. A real-estate report containing property addresses, mortgage figures, and income data. These were among the documents accessible through Meta’s Muse AI sharing feature before the company suspended it on October 20, 2026.
Security firm Claroc reported the issue to Meta’s bug bounty program on October 8. Its findings exposed a critical design assumption. A long, randomized URL is not enough to keep shared AI conversations private when the link’s own hostname is visible to public infrastructure.
How a “Private” Link Became a Public Index
The weakness was not in the random identifier itself, but in where Meta placed sensitive conversation titles.
When Muse users shared AI-generated content, each share got its own web address under Meta’s cf.metaaiusercontent.com domain. That address included both a random identifier and a descriptive conversation title, placed directly in the hostname.
Opening one of those pages required the browser to perform a DNS lookup, the process of translating a hostname into a server address. Passive DNS services record those lookups and make them searchable. They function less like a security camera and more like a permanent guest registry at the front desk: the title of every conversation was logged alongside its address. These systems have also been used to power a surveillance app capable of tracking individuals through public DNS logging.
Claroc searched a commercial passive DNS dataset and found the Muse hostnames listed there, organized by readable conversation titles, according to its published research. The result was something close to a browsable table of contents for shared Muse content. No brute-force guessing of the random identifiers was required.
What Claroc Found
The inspected sample included financial records, workplace documents, and confidential business communications.
More than 6,800 Muse share hostnames appeared in the dataset after Claroc filtered out unrelated scanning activity , among the largest sets of records exposed through unintended public indexing of private content. The firm inspected only a few hundred pages, so the full scope of sensitive material across all 6,800 remains unknown.
The documented examples, reported by The Verge and Wired, were striking. Beyond the CEO revenue review and loan application, researchers found preparation notes for a confidential executive-search call at an AI company. Those notes included an internal contact’s name and a scheduled meeting time. A real-estate report listed property addresses, mortgage amounts, income figures, and investment returns.
Accessing any of it required only an ordinary browser. Claroc confirmed the pages loaded in logged-out and incognito sessions, with no Muse account needed.
Meta’s Response and What the Fix Doesn’t Cover
Meta blocked direct access to shared pages, but hostname records in external systems remain outside the company’s control.
After the research became public, Claroc retested 40 previously accessible shares. None remained available. Meta’s suspension blocked direct access in Claroc’s retest.
The takedown could not remove hostnames already retained by external passive DNS services. Those systems may hold that data for an unknown or extended period, potentially long after the pages were disabled. The title-bearing hostnames may remain in some third-party passive DNS datasets beyond Meta’s reach.
Meta spokesperson Tracy Clayton told The Verge that the company paused the feature while reviewing the report and considering changes to how shared links can be discovered. Meta is also considering changes to link discoverability, Clayton said. No replacement design or restoration timeline was announced.
Claroc said it found no evidence that the links had been misused before its report, though it could not determine whether anyone else had located them earlier.
The Design Lesson
This incident shows that randomized tokens can reduce guessing risk, but they do not prevent discovery when descriptive hostnames are recorded by public infrastructure.
Random tokens in share links can reduce the risk of guessing, much like how apps secretly tracking users rely on obscured but still-logged identifiers. They do not by themselves prevent discovery when the complete hostname is recorded and searchable. A safer architecture would keep sensitive titles and identifiers out of observable hostnames entirely. It would also treat shared AI conversations as confidential by default, not public by convenience.
If you shared a Muse conversation containing sensitive business, financial, or personal information, Claroc found that 40 previously accessible shares were no longer available in its retest. The title-bearing hostname, however, may already exist in some passive DNS records that Meta cannot reach or alter.
