Meta paused the sharing function for its Muse AI assistant on October 20, following the discovery of a design flaw that exposed thousands of user conversations. Cybersecurity firm Claroc reported that over 6,800 shared links to Muse conversations were discoverable online through passive DNS records. These links, intended for sharing specific AI-generated content, inadvertently made sensitive personal and business information accessible without requiring a login.
The vulnerability stemmed from how Muse constructed its shareable URLs. The addresses included conversational titles within the hostname, alongside random identifiers. While the random identifiers made direct guessing difficult, the inclusion of descriptive titles meant that passive DNS services, which record domain name lookups, could store complete hostnames. Researchers could then use these stored records to reconstruct working links, effectively bypassing the intended privacy controls. Claroc dubbed these discoverable pages "GhostShares".
Among the exposed information were internal company documents, financial records, loan applications, and confidential meeting notes. One conversation reportedly contained preparation materials for an executive search call with an AI laboratory. Claroc noted that such information could be used for impersonation, targeted phishing, or financial fraud, although the firm stated it found no evidence of misuse.
Meta confirmed the suspension to Ars Technica, stating that it was reviewing the findings and considering changes to how shared links are discovered. A Meta spokesperson explained that sharing a Muse artifact creates a webpage accessible to anyone with the link, and the company is now examining ways to prevent such links from being easily discovered. Following Meta's announcement, Claroc retested 40 previously accessible shares and found they were no longer open. However, the conversation titles remained visible in historical DNS records.
The incident highlights ongoing privacy challenges with AI assistants, even when sharing features are designed with user privacy in mind. Previous issues have involved shared conversations from other AI models, including ChatGPT, Claude, and Grok, surfacing in search results. While Meta's Muse employed robots.txt to discourage crawler access, this did not prevent discovery through DNS records. Claroc reported its findings to Meta's bug bounty program on October 8, 2026.
Meta launched Muse on September 8, 2026, as a general-purpose AI assistant designed for tasks such as filling out forms, booking appointments, and creating documents, which may require access to personal information. The company has not provided a timeline for the resumption of the sharing feature.