Meta Pulls the Plug on Muse Sharing After Thousands of Chat Links Surface in Public DNS

Meta Pulls the Plug on Muse Sharing After Thousands of Chat Links Surface in Public DNS

A Share Button That Published Its Own Index

Meta's new personal AI agent Muse was supposed to share a conversation only with whoever received the link. Instead, the address of each shared page carried the conversation's own title inside its subdomain, and every share lived under the same domain. Security firm Claroc, which dubbed the pages "GhostShares," said that design choice turned scattered private links into a searchable set: one passive-DNS search returned thousands of them, listed by name, like a table of contents.

One Search, More Than 6,800 Links

In a blog post published over the weekend, Claroc said a single search of public DNS records surfaced more than 6,800 Muse share links. Passive DNS preserves historical domain resolutions, so anyone with access to the same public tools could repeat the lookup without ever being handed a link. The random identifiers after the title made addresses hard to guess, but Claroc noted that guessing was pointless once complete hostnames sat in searchable records.

Hundreds Opened With No Login, Most Mundane, Some Not

Claroc researchers opened a few hundred of the pages with no Meta account and no login. Most were harmless: small-business sites, listings, event calendars. A minority were not. The firm described dozens of pages holding personal and business material users would not normally publish, including a marketing company's internal revenue review, a small business owner's loan application, and a candidate's notes for a confidential executive-search call with a frontier AI lab leader, down to the lab's internal contact and the meeting time.

Meta Says the Behavior Was by Design, Then Pauses It

After Ars Technica asked about the findings, Meta said it was suspending the sharing feature. "People have the ability to share specific Muse artifacts, which creates a page that can be accessed by those with the link," Muse spokesperson Tracy Clayton said in an emailed statement to The Verge. "However, we've paused this functionality while we review this report and consider changes to how these links can be discovered." In a separate statement, Meta said it opened the Muse bug bounty program so researchers could raise different scenarios and help improve the product. Claroc said that after checking similar platforms, consulting industry colleagues, and re-reading Meta's documentation, it judged the behavior by design, but warned users that requesting a share link creates a public page discoverable through passive DNS.

Reported on October 8, Shut Down on October 20

Claroc reported the issue through Meta's bug bounty program on October 8. The firm said it had no evidence anyone misused the pages, and that it could not know how long any share had been reachable or who else found it. In an October 20 update, Claroc rechecked 40 shares that had previously opened without authentication: none opened, and their content hostnames returned errors. The hostnames, titles included, remain in passive-DNS history. One tracker noted the share tier was still minting new hostnames, 27 on the day Claroc last looked, describing it as continued discovery rather than re-verified access. With sharing suspended, users no longer face this particular exposure, at least for now.

A Month-Old Flagship Meets Its First Trust Test

Muse, announced on September 8 as Meta's first personal AI agent, runs on the company's Muse Spark 1.3 model and acts on a user's behalf across mail, shopping, forms, and bookings on iOS, Android, and the web in the United States. Barely a month after launch, its sharing design has handed Meta an early privacy lesson. Changing how share URLs are minted is the easy part; the harder job is convincing users that the revenue reviews and loan forms they hand to an agent will not end up listed in a public index.