Meta pauses Muse chat sharing after a security firm finds 6,800 share addresses in public DNS

Muse put each chat's title in its share address, and DNS records keep those titles searchable even now.

By Think Facility · October 20, 2026 · Meta Privacy

Meta has stopped its Muse agent from sharing conversations as public web pages, after a security firm found thousands of them listed in public internet records. Claroc published the research and, in an update dated October 20, 2026, said 40 shares that had opened without an account earlier in the month no longer opened at all.

Claroc's account of the pause is second-hand. It says Meta told Ars Technica it was suspending the feature once Ars asked about the findings. The share addresses, titles included, are still sitting in DNS history.

Found by: Claroc, a security firm
Shares listed: more than 6,800 share hostnames
Reported to Meta: October 8, 2026
Sharing suspended: October 20, 2026
Muse launched: September 8, 2026

How a shared chat became findable

Muse shares a conversation by publishing it as a page and handing you a link. Anyone with the link can open it without logging in. Claroc says that's by design, since a public page is the only way the coworker you send it to can read it.

A large white roadside sign with a blue infinity loop above a black base reading Meta, 1 Hacker Way, in front of evergreen trees — The entrance sign at Meta's headquarters in Menlo Park, California. Photo: Nokia621, CC BY-SA 4.0, via Wikimedia Commons

The trouble was in the address. Muse built each share's web address from the conversation's title, then a random ID, on a Meta content domain. The first time anyone opened a share, a browser looked the whole name up in DNS, and services that record those lookups keep them searchable, a record called passive DNS.

The title the user typed lands in a public index of domain names.

From GhostShares: A Shared Muse Chat Exposed Prep for a Confidential Call With a Frontier AI Lab Leader | Claroc Blog

So the random ID didn't protect much. It gets published along with the title the moment anyone visits. Claroc says a single passive-DNS search, after filtering out noise, returned more than 6,800 share hostnames, and the titles mostly gave away what a page held before anyone clicked.

What was in them

Claroc opened only a few hundred and says most were dull: small-business sites, listings, event calendars. It describes six that worried it, by category only. One was a job candidate's notes for a confidential executive-search call with a frontier AI lab, naming the lab's internal contact and the meeting time.

Others were a marketing company's internal revenue review marked for its CEO, a small-business loan application with the amount requested, and a workplace's full-year vacation calendar listing dozens of employees. A real-estate investor's report carried two property addresses and mortgage figures.

Claroc says it reported the problem to Meta's bug bounty program on October 8, 2026, and has no evidence anyone misused the shares. It's withholding every hostname and title, and plans to delete what it collected once Meta confirms it has what it needs.

What it means for people who use AI at work

Nobody hacked these pages. Their owners shared them, mostly to pass something to a colleague. Claroc's point is that a company checking Muse's settings wouldn't have caught it, because each share is one employee's request, carried out exactly as designed.

Its advice to employers is blunt. Flag it when staff create public shares, explain how share links behave, and if nothing in the company's tools can see Muse sharing, block muse.ai and Meta's content domain on managed devices. For a small business owner whose loan figures were in a chat title, that's late help.

For anyone who already shared a Muse chat, the pause doesn't wipe the record. The pages stopped opening, but the titles stay in passive-DNS history. I'd treat any shared chat title as public from now on, on Muse or on any other tool that names its share links the same way (Claroc suggests companies audit their other AI tools for exactly that).

What's still open

Claroc's update gives no date for sharing to come back, and we found no Meta post on the pause when we looked on October 20, 2026. On the last day Claroc checked before the pause, Muse was still minting new share hostnames, 27 of them that day.