Meta pauses Muse AI chat sharing after researchers find over 6,800 discoverable links

The sharing feature in Meta’s Muse, its personal AI agent, has been paused after researchers at security firm Claroc found that conversations shared by link could be found even by people who had not been given the link. Claroc shared its detailed research on October 18. Meta then informed Ars Technica on October 20 that it had “paused this functionality while we review this report”.

Meta says Muse can connect to users’ email, calendar, payment, and health apps, as it is designed to act on their behalf. This means a shared conversation can contain far more information than a typical AI chatbot conversation. Although the pause has stopped access to these pages, Claroc claims that the titles of the shared conversations can still be found in commercial DNS databases.

Muse was launched in the US on September 8 for users aged 18 and above. MediaNama has earlier reported that Muse has been maintaining hourly updated profiles of users and the people mentioned in their conversations, as reported by TIME Magazine. After an Inc. columnist claimed that Muse had read his private messages, a claim Meta disputed, Apple announced stricter consent requirements for granting Mac apps full disk access.

How could people find links they were never sent?

When a user wanted to share a conversation, Muse would create a webpage containing it that anyone with the link could access without logging in. However, Claroc said the web addresses were generated using the conversation’s title and a random ID and were hosted on a subdomain of cf.metaaiusercontent.com. This made them discoverable through passive DNS databases. Claroc gave the illustrative example of home-sale-budget-9f21c8a3.cf.metaaiusercontent.com.

When someone clicked on one of these links, their browser would look up the subdomain in the internet’s address book, known as the Domain Name System (DNS). These lookups are recorded and can be searched through passive DNS services. As a result, the full subdomain could end up in their databases.

A single query to a commercial passive DNS service returned more than 6,800 share hostnames, which could be converted back into working links, Claroc said. The firm calls these pages “GhostShares” because they can be opened by “people who were never handed the link”. Claroc noted that Muse had asked search engines not to crawl the shared pages, but Claroc did not need a search engine to find them.

What did the exposed pages contain?

Claroc accessed a few hundred pages. Most contained unremarkable information, such as event calendars and listings. However, some contained sensitive material, including:

• A candidate’s notes for a confidential executive-search call that named an internal contact at an AI lab and included the meeting time.
• A loan application by a small business owner that disclosed the amount requested, part of an account number, and a to-do list mentioning a bank fraud alert.
• An internal revenue review prepared for the CEO of a national marketing company, alongside two property addresses and mortgage figures in a real estate investor’s report.
• A workplace’s annual vacation calendar containing details of dozens of employees’ leave schedules.

Claroc did not contact the users or companies involved and has no evidence that anyone misused the shared information. The firm withheld all identifying information in its report and flagged the issue to Meta through its bug bounty programme on October 8. Asaf Aprozper told Ars Technica that he had also tried to contact Meta employees on LinkedIn but received no responses.

Pausing the feature only partially fixes the problem: On October 20, Claroc rechecked 40 previously accessed shares, none of which loaded. The hostnames serving the pages returned errors. However, before the pause was implemented, around 75 saved scans of Muse share pages had appeared on urlscan.io, a public URL-scanning service, Claroc found.

Responding to MediaNama’s questions, Claroc said content captured before the shutdown “may still exist in third-party archives, cached pages, or saved scans”, adding: “We haven’t verified whether any such copies remain publicly accessible. The important distinction is that disabling the original links doesn’t necessarily erase copies already collected elsewhere.”

Meta’s statement does not clarify whether the links have been permanently disabled or deleted, or whether the sharing feature will keep conversation titles out of web addresses when it is restored. Meta’s help page on sharing Meta AI conversations says that such links do not expire, but Claroc notes that this guidance is not specific to Muse.

What MediaNama has asked Meta

• Whether the pause permanently disables existing share links, or only stops new ones from being created
• Whether the shared conversations have been deleted from Meta’s servers, and how users can delete their own shares
• Whether Meta will stop placing conversation titles in share-link addresses before it restores the feature
• Whether Meta has notified users whose shared pages could be found this way
• Whether Muse, or its sharing feature, was available to users in India, and whether any of the exposed shares belonged to users in India

This story will be updated when Meta responds.

Also read:

• Meta launches Muse, an AI agent that acts across apps; India not in rollout
• Report: How Meta’s Muse AI is building a detailed dossier on you using chats, emails, and relationships