Skip to content
NewA calmer, faster ZeroHour
AI safety & securitymedium

Meta suspends Muse sharing after GhostShares DNS link discovery

Original title: Researchers Uncover GhostShares Flaw That Makes Meta Muse AI Conversations Easy to Find

GBHackersby Mayura Kathir ()3 min read5 · 4 reads
Read at gbhackers.com
Part of a story covered by 6 sourcesMeta restores Muse sharing after replacing discoverable linksMerged summary & timeline
AI summary · x-ai/grok-4.7Summaries by Vani AI

Claroc recovered more than 6,800 share hostnames from passive DNS; sampled pages included budgets and business documents.

Claroc found that Meta Muse public share links put conversation titles and random identifiers in hostnames under cf.metaaiusercontent.com, so passive DNS records could rebuild the links. Meta told Ars Technica on October 20 that it was suspending the feature. Rechecks of 40 previously accessible shares that day failed to open, although historical DNS records still retained titles. The issue was discoverability of intentionally shared chats, not access to private accounts.

Unconfirmed: The 6,800 count is discovered hostnames, not confirmed sensitive chats, and user intent was not established.

Key facts
  • Claroc reported the issue through Meta’s bug bounty on October 8.
  • Only a few hundred of more than 6,800 hostnames were inspected.
  • Researchers said they found no evidence of misuse.
  • Claroc also reported more than 75 saved Muse scans on urlscan.io.
Security assessment · AI, from the articleNo known exploitation

Impact: Shared Muse chats with personal and business documents were discoverable

ProductAffected
Meta Muse—
What to do
  1. 1.Do not treat Muse public share links as secret for sensitive content.
  2. 2.Assume outside DNS history may still retain share hostnames and titles.
Explain this AI news with Vani AIWhat was announced, what is new and why it matters, in a new chat
Tags
metamusepassive-dnsshare-linksprivacydata-exposure
Vendors
Meta
Products
Muse
Organizations
Claroc

From the original article

3 min read at gbhackers.com

A privacy weakness in Meta’s Muse AI assistant that made shared conversations discoverable through passive DNS records, exposing personal files and internal business documents. Dubbed GhostShares, the issue affected public sharing links whose supposedly unguessable identifiers appeared inside searchable hostnames. Meta told Ars Technica on October 20 that it was suspending the feature.

GBHackers

By Mayura Kathir · gbhackers.com

Read the full article at GBHackers

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.