Quick answer: Meta has paused the conversation-sharing feature in Muse, its new personal AI agent, after researchers at security firm Claroc found more than 6,800 shared Muse chats that could be located without ever being sent the link. Muse put each shared conversation’s title into its web address, and those addresses ended up in public DNS records that anyone can search. Among the few hundred pages the researchers opened were a loan application, a company’s internal revenue review and notes for a confidential job call with an AI lab. Meta told Ars Technica it has paused the feature “while we review this report.” Claroc says it has no evidence anyone misused the links.
Muse is barely six weeks old, and it is designed to act on your behalf across your apps. That makes a privacy slip in its sharing tool a bigger deal than it would be in an ordinary chatbot. Here is what happened, how the links were found and what Muse users should do now.
What is Meta Muse?
Meta launched Muse on 8 September 2026 as a personal AI agent that can take actions for its users. CNBC covered the launch. According to Ars Technica, the assistant can fill out forms, book appointments, make purchases and create documents, and it needs access to most of a user’s accounts to do that. Ars notes that Mark Zuckerberg described Muse as “built from the ground up for privacy and security,” and that it quickly climbed to one of the top spots in Apple’s App Store.
Like many AI assistants, Muse lets you share a conversation by creating a link. Anyone who has the link can open the page without logging in. That part is by design: it is how a teammate you send the link to can read it.
How researchers found 6,800 shared chats
The problem was how those links were built. In its report, Claroc explains that Muse served shares from a single content domain, cf.metaaiusercontent.com, and built each share’s address from the conversation’s title followed by a random ID. A simplified example given by the researchers looks like home-sale-budget-9f21c8a3.cf.metaaiusercontent.com.
Why the random ID didn’t help
Because the title and ID sit in the hostname rather than in the page path, the full address has to be looked up in the Domain Name System (DNS) whenever someone opens it. Commercial “passive DNS” services record those lookups and keep them searchable. So the first time a share was opened, its whole hostname, random ID included, could be logged in a database.
Claroc ran one search for hostnames under Muse’s content domain and, after filtering out noise, got back more than 6,800 of them, readable by title. “If you had asked us beforehand, we would have guessed that gathering these would take real effort,” the researchers wrote. “It took one query.” They also found more than 75 saved scans of Muse share pages on the public scanning service urlscan.io.
Muse did ask search engines not to crawl its share pages through its robots.txt file. But as Claroc points out, that controls crawling, not access, and its discovery method never involved a search engine.
What was exposed
The researchers say they opened only a few hundred pages, and that most were unremarkable, such as small-business sites and event calendars. A minority were clearly sensitive. Claroc listed six examples, by category only:
- a candidate’s notes for a confidential executive-search call with a frontier AI lab, naming the lab’s internal contact and the meeting time
- a national marketing company’s internal revenue review, marked for its CEO
- a small-business owner’s loan application, with the amount requested
- a to-do list that included a bank fraud alert, with a partial account number
- a real-estate investor’s performance report, with property addresses and financial figures
- a workplace’s full-year staff vacation calendar
Claroc says it withheld every hostname, title and link from its report and did not contact the people or companies involved.
What Meta said and what changed
According to Ars Technica, Claroc reported the issue to Meta’s bug bounty program on 8 October, and the company’s co-founder and CTO, Asaf Aprozper, said he got no reply. After Ars asked Meta about the findings, the company said in a statement:
“People have the ability to share specific Muse artifacts, which creates a page that can be accessed by those with the link. However, we’ve paused this functionality while we review this report and consider changes to how these links can be discovered.”
A Muse spokesperson gave The Verge the same statement. Claroc says that when it rechecked 40 shares on 20 October that had previously opened without an account, none of them loaded. It adds an important caveat: the hostnames themselves, titles included, remain in passive-DNS history.
It is not Muse’s first security story. Ars reports that three weeks after launch, macOS security researcher Patrick Wardle disclosed a vulnerability that could let another app on the same device take over a user’s Muse account, which Meta played down.
This has happened to other AI chatbots
Shared AI conversations ending up in public is a recurring problem. In 2025, OpenAI removed an option that made shared ChatGPT chats discoverable in search engines after people found private conversations in Google results, Fortune reported. Weeks later, the BBC reported that hundreds of thousands of conversations with xAI’s Grok had been exposed in Google search results through its share feature. The Muse case is different in one way: the pages were found through DNS records, not search engines.
What Muse users should do now
- Treat any share link as public. Whatever an AI assistant puts behind a link can be opened by anyone who gets that link, and links get forwarded.
- Keep sensitive details out of shared chats. Account numbers, loan or salary figures, addresses and names of contacts should not go into a conversation you plan to share.
- Watch your titles. In Muse’s case, the conversation title itself was what became searchable.
- For companies: Claroc recommends finding out who is already using Muse, telling staff what a share link does, and, if you cannot monitor it, blocking
muse.aiandmetaaiusercontent.comon managed devices.
For more on Meta’s AI plans, read about Meta’s Muse Spark model running locally on Apple’s Mac Studio. We also covered AI models hacking real systems during safety tests and Character.ai’s Chapter 11 bankruptcy filing. More in our Tech section.
Frequently asked questions
Why did Meta pause Muse sharing?
Security firm Claroc found that more than 6,800 shared Muse conversations could be located through public DNS records, because each share’s web address contained the conversation’s title. Meta said it paused sharing while it reviews the report.
Were Muse chats leaked to the public?
Only conversations that users had chosen to share were affected. Researchers opened a few hundred of them without logging in, and some contained sensitive personal and business information. Claroc says it has no evidence anyone misused them.
Can people still open my shared Muse links?
Claroc says that after the pause, 40 shares it rechecked on 20 October no longer opened. The hostnames, including titles, are still recorded in passive-DNS history.
What is passive DNS?
It is a historical record of domain-name lookups collected by monitoring services. When someone opens a web address, the lookup can be logged and later searched, which is how the Muse share addresses were found.
Has this happened with other AI chatbots?
Yes. In 2025, shared ChatGPT conversations appeared in Google results before OpenAI removed the option, and hundreds of thousands of Grok conversations were exposed in search results through its share feature.
Sources: Ars Technica; Claroc; The Verge; Engadget; CNBC; Fortune; BBC.
Featured image: network cables and servers in a data center, by Victorgrigas, CC BY-SA 3.0, via Wikimedia Commons. Illustrative image; not a Meta facility.
