Meta suspends Muse chat sharing after researchers find 6,800 conversations exposed in public DNS records

Oct 20, 2026

Meta has suspended the conversation link-sharing feature in its Muse AI assistant after security firm Claroc discovered over 6,800 shared chat URLs accessible via public passive DNS records. Because Muse included conversation titles in hostnames, passive DNS logs created searchable indexes containing sensitive user data, including small-business loan applications, corporate revenue reviews, and job candidate notes. Claroc reported the issue on October 8, 2026, leading Meta to disable shared link resolution while reviewing URL discovery mechanisms.

Meta's suspension of Muse sharing

▪Meta spokesperson Tracy Clayton stated that Meta paused Muse sharing functionality while reviewing Claroc's report and considering changes to how shared links can be discovered.
▪Following Meta's suspension, security firm Claroc rechecked 40 exposed Muse share links on October 20, 2026, and confirmed that none opened and the hostnames returned an error.
▪Meta suspended the conversation link-sharing feature in its Muse AI assistant after security researchers discovered shared chat URLs exposed in public DNS records.

How Muse links were exposed in DNS

▪When a user opens a shared Muse link, DNS resolvers observe and log the full hostname including the title and random ID into public, searchable passive DNS records.
▪Muse generates web addresses for shared chats using the conversation's title and a random ID under the hostnames tier cf.metaaiusercontent.com.
▪Security firm Claroc identified more than 6,800 exposed Muse share links by conducting a single passive DNS query against a commercial database for domain cf.metaaiusercontent.com.

Sensitive data found in exposed links

▪Exposed Muse links accessed by Claroc contained a national marketing firm's internal revenue review marked for its CEO and a small-business loan application with requested amounts.
▪Exposed Muse share URLs revealed a workplace full-year staff vacation calendar, a real-estate performance report with property addresses, and a to-do list with bank fraud alert details.
▪Claroc's review of exposed Muse share links uncovered a job candidate's executive-search notes for a frontier AI lab, including internal contact names and meeting times.

Claroc's reporting and research Timeline

▪Claroc published its GhostShares research detailing the Muse DNS discovery vulnerability on October 18, 2026, while withholding all specific hostnames, links, and user identifiers.
▪Claroc CTO Asaf Aprozper submitted the Muse vulnerability report to Meta's bug bounty program on October 8, 2026, after conducting content checks on October 7 and 8, 2026.
▪Claroc reported that its outreach to Meta staff via LinkedIn and the bug bounty portal initially received no direct reply prior to Ars Technica's press inquiry.

Web scanning and crawler controls

▪Public URL-scanning service urlscan.io held over 75 saved scans of exposed Muse share pages prior to Meta's intervention.
▪Meta's robots.txt file asks search and AI crawlers to stay off Muse share paths, though Claroc noted that robots.txt governs crawling rather than access.

Similar chat exposures in other AI tools

▪Shared AI conversations from OpenAI's ChatGPT, Anthropic's Claude, and xAI's Grok previously surfaced on public search engines like Google after similar chat-sharing features were implemented.
▪In 2025, Google indexed over 370,000 shared Grok AI conversations before accessibility options were adjusted.