Meta has paused the feature in its Muse assistant that lets users share conversations by link, after security researchers showed those links could be found through public DNS records. Researchers at the security firm Claroc said they enumerated about 6,800 shared Muse pages and, after opening a few hundred, found material clearly not meant to be public. Meta told Ars Technica and The Verge it is reviewing the report and considering changes to how the links can be discovered.

Share links normally hide behind a long random string that cannot be guessed. Muse used one, but its design placed the conversation title in the subdomain of the address, under a domain Claroc identified as cf.metaaiusercontent.com. Each time someone opens such a link, the lookup of that host name can be recorded by passive DNS services, which keep searchable histories of domain resolutions.

Claroc called the result “GhostShares”: pages that open for people who were never handed the link and can find it on their own. The researchers said that gathering them was easy: “It took one query.” Ars Technica’s illustrative example addresses show titles such as a home-sale budget or a loan application draft in the host name itself, which makes searching for sensitive topics trivial.

What the researchers saw

Among the pages Claroc opened were a candidate’s notes for a confidential executive-search call, a company’s internal revenue review marked for its chief executive, a small-business owner’s loan application showing the requested amount, and a to-do list containing a bank fraud alert with a partial account number. They also reported a real-estate investor’s performance report with property addresses and financial figures, and a workplace’s full-year staff vacation calendar. We have not seen the pages ourselves and rely on the researchers’ account as reported by Ars.

Meta’s response

Meta said it opened the Muse bug bounty program so researchers could raise issues, that users can share specific Muse artifacts as pages reachable by anyone with the link, and that it has paused that functionality for review. Claroc’s co-founder and CTO, Asaf Aprozper, told Ars he reported the finding through the bug bounty on October 8 and also tried to reach Meta staff on LinkedIn, but got no reply before the story. In the reports we reviewed, Meta gave no further detail.

Why it matters for an agent product

Muse is Meta’s new general-purpose assistant, which can fill in forms, book appointments, make purchases and create documents. To do that it needs access to most of a user’s accounts. TechCrunch reported on Tuesday that Muse reached 10 million U.S. downloads in 40 days, a pace only 11 other apps have matched, with retention above its AI rivals. A large, fast-growing user base raises the cost of a privacy flaw.

Ars also noted that Mark Zuckerberg said last month that Muse was “built from the ground up for privacy and security.” It added that macOS researcher Patrick Wardle had found a separate flaw allowing another app on the same device to take over a Muse account, which Meta played down because exploitation required an already compromised device. Similar questions about how much access agents should receive arise in our coverage of Microsoft’s Guardian Agents and in our guide to least-privilege API keys for AI coding agents.

What users can do now

With sharing paused, new Muse links should not be created. Anyone who previously shared a conversation should assume that the page could have been read by others, avoid reusing any numbers, names or credentials it contained, and check whether the app offers a way to delete shared items. Do not paste financial details or confidential business information into any assistant if you may later share the transcript.

What to watch next

  • Whether Meta restores sharing, and with what changes to link design and discoverability.
  • Whether Meta says how many shared pages were accessed by outsiders.
  • Whether regulators or privacy authorities ask questions about the exposed data.
  • Whether other assistants that publish share pages review their link formats.
  • Whether Meta responds publicly to the earlier Wardle findings.

Key takeaways

  • Claroc found about 6,800 Muse share links through public DNS records and reviewed several hundred.
  • The conversation title appeared in the subdomain, which made the links discoverable.
  • Meta paused sharing and says it is reviewing changes.
  • Muse needs wide account access, so leaks of its content are especially sensitive.
  • Treat any shared AI transcript as potentially public.

Frequently asked questions

Is Muse unsafe to use?

Only the sharing feature was reported as exposing data, and it is paused. Other security reports exist, so users should limit the access they give the assistant.

What is passive DNS?

It is a record of past domain name lookups collected by monitoring services, which lets researchers search for host names that people have visited.

Has Meta confirmed the numbers?

Meta confirmed it paused sharing but, in the reports we reviewed, did not dispute or confirm the 6,800 figure.