The exposure
Meta has suspended the conversation-sharing feature in its Muse AI agent after security firm Claroc discovered that all shared Muse chat links could be found and accessed via a passive DNS search because every URL used the same domain name and included the conversation's title in the subdomain.
Claroc identified 6,800 links for shared Muse chats and accessed conversations containing sensitive information. The material included meeting details involving a leading AI lab, a small-business loan application, a bank fraud alert with partial account information, a company's vacation calendar and internal business documents.
The problem wasn't a breach. The exposure involved a sharing feature that worked as designed: when users asked Muse to share conversations, the assistant created public pages accessible to anyone holding the link. Researchers discovered that outsiders could find those links through passive DNS records without receiving them.
What made the links discoverable
Muse generated sharing URLs using a predictable structure that incorporated conversation titles into web addresses under the cf.metaaiusercontent.com domain, and because the conversation title appeared in the hostname, the links could be identified through passive DNS searches, which preserve historical records of domain activity.
Claroc explained in a blog post that "Muse names each share's web address after the conversation's own title, and that address is written into public DNS," and "One passive-DNS search brings back thousands of them, listed by name, like a table of contents."
Opening a sample in incognito, with no login, revealed people's personal files and companies' internal documents: a home-sale budget, a to-do note flagging a bank-fraud alert with a partial account number, a small-business loan application, a CEO-only revenue review, and a candidate's confidential prep for an executive-search call with a frontier AI lab.
Muse names each share's web address after the conversation's own title, and that address is written into public DNS.
Claroc research teamClaroc, which named the findable pages "GhostShares," reported the flaw to Meta's bug bounty program on 8 October, and Meta told Ars Technica it was suspending the feature after the outlet asked about the findings.
Meta's response
In a statement to Ars Technica, Meta said "we've paused this functionality while we review this report and consider changes to how these links can be discovered."
When Claroc rechecked 40 shares on 20 October that had opened without an account earlier in the month, none opened, and the hostnames serving their content returned an error. However, historical DNS records still retained hostnames, including conversation titles, and blocking access did not remove every trace of the exposure.
Muse is an artificial intelligence agent developed by Meta Platforms, announced on 8 September 2026, and Meta describes it as a personal AI agent capable of carrying out long-running tasks on a user's behalf, rather than answering queries in a single exchange as a chatbot does.
What it means for social media professionals
The Muse incident matters because social media teams are often early adopters of AI tools for drafting copy, planning campaigns, summarising research or coordinating with agencies. If you've used Muse to share a conversation about an upcoming launch, influencer budget, or competitor analysis, the conversation title itself may still be sitting in passive DNS logs where anyone running a subdomain search can find it.
The exposure wasn't limited to what's inside the chat. The title alone, visible in the DNS record before the page loads, signals what you were working on: "Q3-revenue-review," "new-product-brief," "partnership-deck-notes." That metadata can tell a competitor, journalist or recruiter exactly what your team is discussing, even if they never open the link.
This is the risk with any AI tool that uses link sharing: convenience and collaboration collide with the reality that once a URL structure becomes enumerable, every conversation you share becomes potentially discoverable by anyone who knows where to look.
Three practical steps:
Audit what you've shared. If your team used Muse's sharing feature, assume those conversation titles are now in DNS records. Check whether any of those titles reveal strategy, client names, budget figures or launch dates you wouldn't want public.
Treat link sharing like publishing. If an AI tool offers a "share this conversation" feature, assume that link could eventually be indexed, scraped or discovered. Don't share anything through an AI tool you wouldn't be prepared to defend if it surfaced publicly.
Set clear AI usage policies. Most social media teams are using multiple AI tools without centralised oversight. This is the moment to document which tools are approved for which types of content, what can be shared externally, and who's responsible for reviewing usage. Our breakdown of Meta's GEM ad auction model and how Muse sits between your audience and your brand show how Meta's AI infrastructure is reshaping workflows across the platform. The sharing flaw is a reminder that AI adoption carries operational risk, not just opportunity.
The broader pattern
This isn't the first time AI sharing features made chats more public than intended, as conversations with OpenAI's ChatGPT, Anthropic's Claude, and xAI's Grok have wound up on Google Search.
The pattern is consistent: AI companies ship sharing features optimised for ease of use, and the security model assumes that a long, hard-to-guess URL is sufficient to keep a shared conversation private. That assumption breaks when the URL structure itself becomes discoverable through public records, search engines or subdomain enumeration tools.
For social media professionals, the lesson is not to stop using AI tools. It's to stop assuming that "shared with a link" means private. DNS records are public. Search engines index aggressively. And once a conversation is shared, you've lost control over where that link travels and who finds it.
Muse has been live for six weeks. Claroc said it had no evidence anyone had misused the shares. But the fact that 6,800 links were discoverable through a single search, by researchers who had no prior access to them, shows how fragile the security model was.
Meta responded quickly once the issue was reported publicly. Claroc reported the findings to Meta's bug bounty program on 8 October. The feature was paused by 20 October. That's a fast turnaround. But it also means anyone who used Muse sharing between 8 September and 20 October may have created discoverable records that are still sitting in DNS logs, even though the pages themselves are now offline.
If you're running social strategy, managing creators or coordinating campaigns through AI tools, this is your reminder that sharing a conversation isn't the same as having a private conversation. Treat every AI chat you share like a document you've published, because functionally, that's what it becomes the moment you click "create link."