Meta pauses Muse sharing after chat links leak via DNS
Original title: Meta Muse AI Privacy Flaw Exposes Confidential Business Data Through Shared Chat Links
Passive DNS preserved secret share hostnames, so finders could open pages without an account or a bypass.
Meta paused Muse AI conversation sharing on October 20 after Claroc reported that shared page hostnames could be recovered from passive DNS and opened without login. Claroc, calling the pages GhostShares, reported the issue on October 8. After filtering noise it counted more than 6,800 share hostnames but opened only a few hundred; a minority held business or personal records. Rechecks of 40 links that day failed, though old DNS records still hold hostnames and titles.
Unconfirmed: Claroc's sample cannot show total exposure, how long pages stayed up, or whether others opened them.
- Claroc reported the issue to Meta's bug bounty on October 8, 2026.
- Share hostnames on cf.metaaiusercontent.com combined titles with random IDs.
- More than 75 urlscan.io snapshots offered another way to find pages.
- Meta said on October 20 it paused sharing while reviewing link discovery.
Impact: Unauthenticated access to user-shared Muse conversations
| Product | Affected |
|---|---|
| Meta Muse AI | — |
- 1.Review whether employees shared Muse business conversations
- 2.Treat public share links as not limited to named recipients
- 3.Block muse.ai and metaaiusercontent.com where controls are lacking
From the original article
3 min read at cybersecuritynews.com
Meta has paused Muse AI’s conversation sharing feature after a privacy flaw exposed confidential business records and personal details through discoverable chat links. The problem affected pages users chose to share, not every private Muse conversation. Anyone who found an affected link could open its contents without signing in.
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.