Meta has switched off conversation sharing inside Muse, its personal AI agent, after a security firm demonstrated that shared chats could be harvested from public internet infrastructure without anyone ever receiving a link. The culprit was a naming decision: Muse built each share’s web address out of the conversation’s own title, and that title was written straight into the public DNS.
Claroc, the firm behind the research, reported the flaw through Meta’s bug bounty programme on October 8 and published its findings on October 18. Two days later, the feature was gone. Meta spokesperson Tracy Clayton said the company had paused sharing while it reviews the report and weighs changes to how shared links can be discovered. No replacement design and no restoration date have been announced.
- The design flaw: Every Muse share lived under one Meta domain, with the chat’s readable title plus a random identifier placed in the hostname rather than the URL path.
- The discovery channel: Passive DNS services log hostname lookups. One query against a commercial dataset returned more than 6,800 share addresses, sorted by title.
- The collateral damage: Among a few hundred pages inspected were a CEO-only revenue review, a small-business loan application and notes for a confidential call with an AI lab.
A table of contents, one DNS query away
Each shared conversation generated its own address beneath cf.metaaiusercontent.com, combining a descriptive title with a randomised string. Because opening the page required the browser to resolve that hostname, the lookup was observed and archived by passive DNS providers, which sell searchable records of domain traffic.
The random identifier, intended to make links unguessable, offered no protection once the full hostname was logged. As Claroc put it: “A search of passive DNS returns thousands of them, listed by name, like a table of contents.” The firm added that guessing was never the point, and that assembling the index cost “one query.”
A second, independent trail existed too: the public scanning service urlscan.io already held more than 75 captures of shared Muse conversations. Meta’s robots.txt file, which asked search and AI crawlers to stay away from share paths, addressed none of this, since robots.txt governs crawling rather than access.
What the exposed pages actually contained
Precision matters here, because several outlets inflated the numbers. Claroc identified more than 6,800 share hostnames, but that is not 6,800 sensitive conversations confirmed in the wild. The team opened only a few hundred and left the rest untouched, concluding that “most of what we opened was anodyne” and that the troubling pages were a minority.
That minority was serious. Documented cases included preparation notes for a confidential call with an AI laboratory, complete with an internal contact and a scheduled time; a company revenue review intended for the chief executive alone; a small-business loan application with the requested amount; a task list alongside a bank fraud alert carrying a partial account number; a property report listing addresses, mortgage figures and returns; and a staff holiday calendar showing every employee’s week away.
No credentials were needed. The pages loaded in logged-out and incognito sessions. The researchers did not brute-force anything, did not sign in, did not submit forms, and left alone the single page that demanded a password. They also found no evidence of misuse, and no source has published a figure for how many people were affected.
A fix that stops at Meta’s edge
On October 20, Claroc rechecked 40 links that had opened without an account earlier in the month. None loaded; the hosts serving them returned errors. But suspending a feature cannot unwind history: the title-bearing hostnames remain in third-party passive DNS archives that Meta neither controls nor can edit.
Meta’s documentation offers only partial cover. Its help page warns that anyone holding a link can read the conversation, that links never expire and that they can be forwarded. Yet that page describes Meta AI rather than Muse specifically, and nowhere does it disclose that a chat title becomes a public domain name.
The contrast with the product’s marketing is uncomfortable. Muse was presented as an agent built from scratch to be secure, protected and private, running in a dedicated isolated virtual machine, with a Sentinel component vetting outbound traffic and no visibility into passwords or payment instruments. All of that may be true and still miss the point: a strongbox is worth little if the label on the door spells out what is inside.
The broader pattern is what should worry the industry. Shared ChatGPT conversations surfaced in search results in 2025 before OpenAI pulled the indexing option; Google later indexed more than 370,000 Grok conversations; Claude shares turned up in search engines in July 2026; and Meta itself pushed conversations into a public feed in June 2025. For Muse, this is the second privacy controversy in a month, arriving just as the agent passed five million downloads. Publishing something and making it findable are separate engineering problems, and the gap between them sits in URL construction, not in a settings menu — which is precisely why privacy audits built around toggle lists keep missing it.