How Meta Muse share links exposed private chats

Muse, Meta's new AI agent, has a privacy problem in an unexpected place: its share links. Researchers at security firm Claroc were able to find thousands of conversations that users had shared with specific people, Ars Technica reports. After Ars asked about it, Meta paused the sharing feature. Here's how it happened and what it means for you.

What the researchers found

Claroc says it listed about 6,800 Muse share links and opened a few hundred of them, without logging in. Among them, according to the researchers' write-up and Ars:

• notes for a confidential executive-search call with a frontier AI lab, including the contact's name and the meeting time;
• a company's internal revenue review prepared for its CEO;
• a small business's loan application with the amount requested;
• a to-do list with a bank fraud alert, a partial account number and a transaction;
• a workplace's full-year staff holiday calendar.

"It took one query," the researchers wrote.

How a private link became searchable

Most share features create a long, random web address that nobody can guess. Muse did that too, but with a twist. Every link lived on its own subdomain of cf.metaaiusercontent.com, and that subdomain started with the conversation title. A simplified example looks like loan-application-draft-a4c9e2.cf.metaaiusercontent.com.

That matters because of passive DNS. When anyone opens a website, their device asks a DNS server to turn the name into an IP address. Commercial passive DNS services quietly record those lookups at resolvers around the world and keep a searchable history. The page itself stays private, but its hostname does not. So when the person you sent a Muse link to opened it, the full subdomain, title and random string included, could end up in these databases. Search them for metaaiusercontent.com and you get a list of shared chats, complete with readable titles.

If the title had been in the path (the part after the first /), DNS would never have seen it. Claroc calls such pages "GhostShares": pages that open for people who were never sent the link.

What Meta says

Meta told Ars that people can share Muse artifacts through a link, and that it has "paused this functionality while we review this report and consider changes to how these links can be discovered." Claroc's CTO, Asaf Aprozper, says he reported the issue through Meta's bug bounty programme on 8 October and got no reply. Ars also notes that a macOS security researcher, Patrick Wardle, reported a separate Muse account-takeover flaw three weeks after launch.

What you should do

• Assume any "anyone with the link" page is public. This applies to every AI assistant, not just Muse.
• Don't put personal or business secrets in chats you plan to share. Copy the useful part into a document you control instead.
• Give work chats neutral titles. In this case, the title itself was the leak.

Muse is designed to act for you across your accounts. We covered why that worries banks in our story about banks and Amazon blocking AI agents. The recent OpenCode API key breach shows the same lesson for developers. If you'd rather keep AI on your own hardware, read our guide to laptops for local AI.