Meta has paused link sharing in its Muse AI assistant after security researchers showed that about 6,800 supposedly private shared conversations could be discovered and opened through public DNS records. The flaw, dubbed “GhostShares,” turned shared chat links into a searchable public index, and Meta confirmed the pause on October 20, 2026.

What Researchers Found

Over the weekend, researchers at security firm Claroc found that Muse generated share URLs in a predictable format, placing each conversation’s title inside the web address under a common domain structure. “Muse names each share’s web address after the conversation’s own title, and that address is written into public DNS,” Claroc said in a blog post. “One passive-DNS search brings back thousands of them, listed by name, like a table of contents.”

Passive DNS services archive observed domain lookups, so a single search could return the full hostnames, including the random identifier that was supposed to keep each link secret. Claroc identified approximately 6,800 shared Muse chat links and, after opening a sample, found conversations containing sensitive material: meeting details involving a leading AI lab, a small-business loan application, a bank fraud alert with partial account information, a company’s vacation calendar, and internal business documents, as first reported by Ars Technica.

Anyone who found an affected link could open its contents with no sign-in required. The exposure affected pages users chose to share, not every private Muse conversation. Claroc also found more than 75 saved scans of Muse share pages on urlscan.io, another route to discovery, CybersecurityNews reports.

GhostShares: what researchers found

Graphic: GPTOnline, using Meta assets

Reported, Then Paused

Claroc said it reported the issue to Meta’s bug bounty program on October 8, after checking pages on October 7 and 8. In a statement emailed on Tuesday, a Meta spokesperson said the company launched the Muse bug bounty program to let researchers identify potential issues, adding that shared Muse content generates a webpage accessible to anyone with the link. “However, we’ve paused this functionality while we review this report and consider changes to how these links can be discovered,” the spokesperson said.

Claroc subsequently reported that its researchers could no longer open a sample of links they had previously accessed following Meta’s update. “We are glad to see it closed this quickly,” the update read.

A Design Flaw, Not a Hack

Claroc describes the exposure as a sharing design weakness, not malware or a confirmed attack. Muse placed shared content under cf.metaaiusercontent.com, combining a readable conversation title with a random ID in each hostname. Although the ID made guessing difficult, passive DNS preserved the complete hostname whenever participating services observed a lookup, letting researchers rebuild working links with no password guessing or security bypass, Dataconomy notes.

Muse’s robots.txt asked search and AI crawlers to avoid share paths, but that did not restrict who could open a page or prevent DNS records from being stored. It echoes an earlier pattern with ChatGPT shared conversations, except this discovery relied on DNS history rather than indexed search results, making crawler restrictions beside the point.

How the chats leaked

Graphic: GPTOnline, using Meta assets

Why It Matters

The incident lands at a delicate moment for Meta’s AI push. Muse launched last month, and TechCrunch reports it reached 10 million US downloads in 40 days, a milestone only 11 other apps have hit. Mark Zuckerberg said last month that Muse was “built from the ground up for privacy and security.” The GhostShares episode shows how AI assistants that people entrust with loan applications, meeting notes, and business documents can leak that material through infrastructure nobody thinks to check, like DNS records, and why every link-based sharing feature in an AI product deserves a second look.

Sources