Meta pauses Muse sharing after chats surface via DNS

By VK

Published 21 Oct 2026, 10:57 UTC

Reporting from Ars Technica, TechCrunch, The Verge

Meta paused Muse conversation sharing after Claroc found about 6,800 share links through DNS records, some exposing business and personal data.

What it means for founders

Treat every share link as public. If your team used Muse, or any assistant, to draft revenue reviews, loan paperwork or hiring notes and then shared them by link, assume strangers could have read them. List what was shared and change anything sensitive those chats mention, such as account details or meeting times.
Hostnames are not secrets. If your product generates share URLs, keep descriptive text out of subdomains, because DNS lookups are logged by third parties. Put only a long random token in the address, and add expiry or sign-in for anything sensitive.
Agent trust is the product. Muse asks for email, calendars and payments, and it already keeps detailed profiles of the people in your life. Each exposure gives cautious buyers a reason to wait, which opens room for agent startups that can show exactly how shared output is protected.
Watch the relaunch. The signal to track is whether Meta brings sharing back with a new link design, and whether it acknowledges Claroc's report.

The story

Meta has switched off the feature that let Muse users share conversations by link, after security firm Claroc showed that thousands of those pages could be found by people who were never sent them. Meta confirmed the pause to Ars Technica, which reported the findings on Tuesday, October 20, and said it was reviewing the report and weighing changes to how the links can be discovered.

How the share links leaked

Each Muse share page sat on its own subdomain of cf.metaaiusercontent.com, and that subdomain started with the conversation's title followed by a random string. When a recipient opened a link, the lookup could be captured by passive DNS services, commercial databases that log which hostnames have been resolved over time. Since the title and ID in the hostname are enough to rebuild the full address, anyone searching those databases could reach the page. Claroc, which calls the exposed pages GhostShares, says one query turned up roughly 6,800 share links.

The firm opened a few hundred. By its account they held prep notes from a candidate heading into a confidential recruiting call at a leading AI lab, a revenue review addressed to a marketing firm's CEO, a loan request from a small business owner, return and mortgage numbers from a real estate investor, a fraud warning from a bank that showed some digits of an account, and a year of staff holiday dates for one workplace.

Claroc co-founder and CTO Asaf Aprozper told Ars he reported the issue through Meta's bug bounty on October 8 and heard nothing back, there or on LinkedIn. Meta opened that program to everyone at launch, with payouts as high as $300,000, according to its Muse security write-up.

Why the scale matters

Sensor Tower figures cited by TechCrunch put Muse at 10.9 million downloads in the weeks after its September launch, with 10.2 million in the US, and it is only offered in the US and Canada for now. The agent needs most of a person's accounts connected to do its job, and this follows an earlier security scare, after Meta patched a Mac flaw that let local code take over Muse. The Verge points out that shared chats from ChatGPT, Claude and Grok have also surfaced in Google results.

What we don't know yet

How long sharing stays off, and whether a fix will move titles out of the hostname.
Whether Meta will tell users that their shared conversations were reachable.
Whether anyone besides Claroc collected the links before the pause.