Meta Muse share links can be found through public DNS records, researchers say

What the researchers found

Conversations that people share from Meta's Muse AI agent can be found by strangers who were never sent the link, according to research from the security company Claroc. Its post, dated 18 October 2026, says a single search of a commercial passive-DNS database returned more than 6,800 Muse share addresses, listed by the title of each conversation.

Claroc's researchers opened a few hundred of the pages without logging in and found that most were harmless, but a minority held personal records and internal business documents. Ars Technica reported the findings on 20 October. Claroc calls the problem GhostShares: pages that open for people who were never handed the link, and that those people can find on their own.

The research does not describe a break-in. Each page exists because a Muse user asked the agent to share a conversation, and Muse did what it was asked. The issue is how the share address is built.

How a share link ends up in DNS

When a user asks Muse to share a conversation, it publishes the conversation as a web page and returns a link. Anyone with the link can open it without signing in, which Claroc notes is by design, since that is how the person it is sent to can read it.

According to Claroc, Muse builds each share's web address from the conversation's title, then a random ID, as a subdomain of cf.metaaiusercontent.com, the content domain Muse serves shares from. Ars gave simplified examples in the form home-sale-budget-9f21c8a3.cf.metaaiusercontent.com.

The random ID is long enough that nobody could guess it. But a hostname is not a secret. When anyone opens the link, their browser looks up that hostname in the domain name system (DNS), and passive-DNS services, which record lookups their sensors see and keep them searchable, can log the whole name, ID included. Claroc also found more than 75 saved scans of Muse share pages on urlscan.io, a public URL-scanning service.

Claroc notes that Muse's robots.txt file asks search and AI crawlers to stay off the share paths. That keeps pages out of search engines, but robots.txt governs crawling, not access, and the DNS route never touches a search engine.

What the exposed pages held

Claroc described six of the sensitive pages by category only, without names or links. They were a candidate's notes preparing for a confidential executive-search call with a frontier AI lab, naming the lab's internal contact and the meeting time; a national marketing company's internal revenue review marked for its CEO; a small-business owner's loan application with the amount requested; a to-do list with a bank fraud alert, a partial account number and a transaction amount and time; a real-estate investor's performance report with two property addresses and exact return, income and mortgage figures; and a workplace's full-year staff vacation calendar.

The researchers say they confirmed the two companies are real using public sources but did not contact the people involved. They argue the call-prep page shows a particular risk: the biography might be public, but who is quietly meeting whom, and when, is not, and a page like that turns public parts into a private fact.

What Meta has said

Claroc says it reported the issue to Meta's bug bounty programme on 8 October 2026 with reproduction steps and example shares. Asaf Aprozper, Claroc's co-founder and chief technology officer, told Ars that the company never received a reply, and that after checking similar platforms and Muse's documentation it concluded the behaviour is by design.

A Meta representative did not immediately answer Ars's questions. AI Lookout found no public statement from Meta on the findings as of 20 October. Claroc quotes a Meta help page, written for Meta AI rather than Muse specifically, which says people with a shared link can see the conversation, that the link does not expire, and that people can share the link onward.

Claroc says it has no evidence that anyone misused the shares. Through passive DNS alone it saw the service keep creating new share hostnames, 27 on the last day it looked.

Not the first AI share-link leak

Claroc places the finding in a line of AI share-link exposures. In 2025, shared ChatGPT conversations appeared in Google results and OpenAI removed the option that made them indexable; weeks later, Google had indexed more than 370,000 Grok conversations, the post says. Blocking search crawlers became the standard fix, and Muse applies it.

What is different here, in Claroc's account, is that the title of the conversation sits inside the hostname. Many products put share IDs in the path of a web address, which DNS lookups do not reveal; putting a readable title and ID in a subdomain publishes both to any service that records DNS traffic.

Exposure through convenience features is becoming a pattern for AI tools. Earlier this month, a test in which six AI agents chased a £350 train refund ended with one agent leaking a family illness, and the OpenCode breach exposed saved AI provider keys for 1.4 percent of Console users.

What Muse users and companies can do

For individual users, the practical advice from Ars and Claroc is simple: treat any shared Muse conversation as public, keep personal and financial details out of conversations you plan to share, and delete share links when they are no longer needed. A neutral conversation title also reveals less, since the title is what appears in the hostname.

Claroc's advice for companies is to find out who is already using Muse, which needs no admin rollout, and to say in AI usage guidance what a share link does. Where a security team cannot see or govern Muse sharing, Claroc suggests blocking muse.ai and metaaiusercontent.com at the proxy or DNS filter on managed devices, which it calls a blunt control.

It also suggests teams check their own exposure the same way, by searching passive DNS and urlscan for the content domains of the AI and software-as-a-service tools staff use, and by creating a test share to see what lands in the address. Claroc sells a product that flags public share links, so its recommendations are not neutral, though the checks it describes can be done with other tools.

The limits of the research

Claroc stresses that this is one discovery channel and one hostname pattern on one product over a short window, not a measure of Muse's total exposure. It cannot tell how long any share was reachable or whether someone else found it first.

The researchers say they guessed and brute-forced nothing, only viewed pages that loaded without an account, and did not log in, fill in forms or upload anything; one page asked for a password and they left it. Content checks were made on 7 and 8 October, and they re-opened one page on 18 October for a redacted screenshot. They are withholding every hostname, title and link and say they will delete the discovery data once Meta confirms it has what it needs.

AI Lookout did not search passive DNS or open any Muse share pages for this article.

Why it matters for AI agents

Muse is Meta's general-purpose personal agent, which Claroc says launched on 8 September 2026 and which Ars says quickly reached one of the top spots in Apple's App Store. It can fill out forms, book appointments, make purchases and create documents, and it needs access to many of a user's accounts to do that. Meta has since expanded the models behind it, including the Muse Wonder family launched on 12 October.

Ars notes that Mark Zuckerberg said Muse was built from the ground up for privacy and security, and that three weeks after launch the macOS security researcher Patrick Wardle found a flaw that let another app on the same device take over a user's Muse account, which Meta played down.

An agent that holds that much context makes every sharing decision more consequential. Claroc's closing point is that nobody broke in: the tool works as built and people use it. Whether Meta changes how share addresses are built, for example by dropping the title from the hostname, is the next thing to watch.