Meta has paused its Muse chat sharing feature after cybersecurity bug hunters found thousands of user chats exposed through passive domain name system records. As reported by Anna Washenko for Engadget, investigators at Claroc cataloged more than 6,800 web addresses created for shared chats, allowing outside users on the web to locate and read personal chats without creating an account or typing a password [1]. The exposed pages included business loan files, private revenue reviews, and complete staff vacation plans. Emma Roth at The Verge reported that Meta paused the tool while reviewing the flaw [2].
How Muse Chat Sharing Works in DNS
Claroc published its GhostShares report on October 18, 2026, warning that anyone on the web could locate and read shared chats without an invitation link [3]. Mark Zuckerberg introduced Muse on September 8 as a Meta AI personal agent built for privacy and safety [5]. Users could share chats as open web pages [3]. When Meta launched Muse with shopping tools in September, Meta Platforms promoted secure agent tools, but bug hunters soon found that the design of Muse chat sharing made links discoverable through basic network records [1].
The bug came from how Meta built sharing links. Whenever an account holder decided to share a chat, Muse minted an address under the content domain cf.metaaiusercontent.com that put the chat’s own title directly into the subdomain, followed by a random code. That random code was long enough to prevent guessing. But passive DNS systems log domain names whenever web browsers look them up, storing those lookups in searchable indexes that network tools collect [3]. Because the domain naming pattern stayed the same, one search query returned thousands of titles listed like an open table of contents. Claroc said the setup made private links searchable across the web [1].
Claroc sent its report to the Meta bug bounty portal on October 8, 2026. Miles Okada at Unite.AI reported that public scanning engines had already indexed the links, with urlscan.io saving more than 75 scans of Muse chat pages. Claroc said its team never bypassed login screens, leaving password-protected links alone [3].
Records Exposed in Network Logs
Most shared chats Claroc found contained routine test questions [3]. But a private minority held secret company files and personal data, leading Yash Thakker at explainx.ai to report that Claroc checked a few hundred live links to measure risk [6]. Almost every live link opened on sight in a web browser without asking for an account [3].
The exposed records covered both company work and personal lives. In one chat, a national marketing firm assembled an internal revenue review marked for its CEO, while another chat held a full-year vacation calendar from a United States workplace detailing dozens of workers with scheduled absence dates [5]. A small loan application named the business owner and requested funding sum [3]. A personal to-do list held a bank fraud warning containing a partial account number, specific transaction sums, and exact timestamps [1]. Another chat showed an executive job candidate preparing for an interview with an AI lab, listing the lab’s confidential contact person and meeting time [5].
Claroc confirmed that two companies named in the exposed files were real firms by checking public registries, but researchers chose not to contact their offices. The team saw no proof of outside parties abusing the data. To protect the people involved, Claroc withheld all company names, chat titles, and money figures from its public report [3].
The GhostShares Research
Claroc described Muse link sharing as an architectural blind spot on cf.metaaiusercontent.com. Web servers can shield URL paths from search crawlers, but internet architecture forces browsers to resolve hostnames publicly through DNS resolvers, meaning that subdomains get recorded in resolver logs whenever users open them [6]. Meta placed robots.txt rules on Muse. But robots.txt only tells search crawlers what to index, so it does nothing to prevent network resolvers from logging hostnames [3].
Public link sharing has triggered privacy problems across several AI tools over the past two years [2]. In 2025, public OpenAI ChatGPT chats surfaced in Google Search results until OpenAI altered how shared pages functioned. Google Search also indexed more than 370,000 conversations from xAI’s Grok agent [3]. In an earlier incident during 2025, security provider Malwarebytes found a bug in an older Meta virtual assistant that left private user conversations exposed to outsiders. Agentic tools like Muse create heightened data risks because users connect them to personal files, calendars, and messages. When users share an artifact, the page often carries sensitive synthesized work that reveals far more than a single text prompt [6].
Claroc retested 40 shared links on October 20, 2026, after Meta updated its servers. None of the links loaded, with subdomains returning server errors instead of chat text. “We are glad to see it closed this quickly,” Claroc wrote in an update to its report. But the firm warned that past hostnames and chat titles stay cataloged in public passive DNS logs [3].
Why Muse Chat Sharing Was Suspended
The move to suspend Muse chat sharing followed inquiries from Ars Technica and The Verge, with Emma Roth reporting on the shutdown. “People have the ability to share specific Muse artifacts, which creates a page that can be accessed by those with the link,” Muse spokesperson Tracy Clayton said in a statement. “However, we’ve paused this functionality while we review this report and consider changes to how these links can be discovered.” [2] Meta hasn’t said if it will alert affected users [6].
The pause comes as Meta works to expand consumer access and its Muse Wonder frontier model. Ananya Gairola at Yahoo Tech reported that Sensor Tower tracked about 2.8 million downloads for Muse during its first two weeks on app stores. Analysts view the agent as a major growth engine. Truist strategist Shay Boloor estimated that Muse could generate $29 billion in annual revenue by 2030, with $11 billion arriving from subscription plans. Analyst Dan Ives projects that Meta will generate revenue from its 3.5 billion user accounts by connecting the software to Facebook and Instagram. Meta Platforms reports third-quarter financial results on Wednesday, with analysts anticipating quarterly revenue reaching $63.36 billion, compared to $51.24 billion generated in the previous year’s third quarter [4].
Muse had already faced security scrutiny in September. Columnist Jason Aten reported in Inc. magazine that Muse accessed Apple Messages on his Mac without permissions. Meta spokesperson Andy Stone replied that Muse only accesses Apple Messages with explicit user consent [4]. Reuters and The Information also reported that Meta added safety notices after a researcher spotted cloud workspace flaws [5].
Enterprise AI Guidelines
Stephen Owens at Human Resources Director reported that the leak alarmed human resources and data compliance managers. Because Muse needs no admin permissions to install on Apple Mac or Windows devices, workers often connect the assistant to workplace email and calendar accounts on their own. Unmonitored tool adoption exposes company assets without IT oversight [5].
Surveys show that unapproved AI adoption is already common across company networks. In Kiteworks’ 2026 Data Security and Compliance Risk report, 65 percent of organizations discovered employees using unapproved AI apps with sensitive business data. Among those companies, 31 percent found employee personal data and human resources files flowing into outside tools. Written rules alone do not eliminate employee use. According to CalypsoAI research from 2025, 52 percent of staff across United States workplaces admitted turning to artificial intelligence tools to simplify daily assignments despite explicit company rules. When accounting network Plus More conducted an internal audit, management discovered staff using unauthorized AI tools on company devices [5].
“We’ve learned that having a policy is not enough; teams need to hear the key messages clearly, repeatedly, and in different ways,” said Anna Crow, head of people and culture at Plus More. Andy Challenger at outplacement firm Challenger, Gray & Christmas urged legal, IT, and HR teams to coordinate AI governance. Security analysts at Gartner echoed that guidance this week. Claroc summarized the vulnerability: “Nobody broke in. The tools work this way, and people use them.” [5]
- ONLINE NEWS Washenko, A. (2026, October 20). Meta suspends Muse chats sharing feature after it left private details exposed. Engadget. [Article Link]
- ONLINE NEWS Roth, E. (2026, October 20). Meta pauses Muse sharing after researchers find AI chats on the web. The Verge. [Article Link]
- ONLINE NEWS Okada, M. (2026, October 20). Meta Suspends Muse Chat Sharing After Researchers Find Links in Public DNS. Unite.AI. [Article Link]
- ONLINE NEWS Gairola, A. (2026, October 21). Meta Pauses Muse AI Sharing After Researchers Say 6,800 Chats Were Exposed ‘Like a Table Of Contents’. Yahoo Tech. [Article Link]
- ONLINE NEWS Owens, S. (2026, October 20). Meta Muse AI stops sharing feature as corporate leaks exposed. Human Resources Director. [Article Link]
- WEBSITE Thakker, Y. (2026, October 20). Meta Muse Share Links Leak: 6,800 Chats Found in DNS. explainx.ai Blog. [Article Link]
