Meta restores Muse sharing after replacing discoverable links
No reports after October 22 add facts beyond Meta restoring sharing and replacing old artifact URLs.
Meta restored Muse sharing after replacing old public links that Claroc recovered from passive DNS.
Claroc reported on October 8 that Meta Muse share hostnames on cf.metaaiusercontent.com combined titles with random IDs, so passive DNS could rebuild links anyone could open without an account. One query recovered about 6,800 hostnames; researchers opened a few hundred and found business and personal material, including a revenue review, a loan application, and a partial bank-account number. Unshared accounts were not exposed, and Claroc said it found no evidence of misuse. Meta told Ars Technica on October 20 that it paused sharing; rechecks of 40 links that day failed. The Verge reported on October 22 that sharing was restored. David Singleton said the issue concerned shared artifacts such as documents and images, not chat sharing, and that old links now require a new URL from the sharer. Other outlets had described the paused feature as conversation sharing.
- Claroc filed the report through Meta’s bug bounty on October 8.
- Hostnames used cf.metaaiusercontent.com and included titles plus random IDs.
- Researchers opened a few hundred of roughly 6,800 recovered hostnames.
- More than 75 urlscan.io snapshots also preserved Muse pages.
- Meta paused sharing on October 20 and restored it on October 22.
- Old artifact links no longer open and require a new URL from the sharer.
Timeline
dated events in the reporting · oldest first- Oct 8, 2026Claroc reports GhostShares through Meta’s bug bounty · Cyber Security News
- Oct 20, 2026Meta pauses Muse sharing while reviewing the report · The Verge
- Oct 20, 2026Rechecks of 40 previously open links fail · Cyber Security News
- Oct 22, 2026Meta restores sharing and replaces old artifact URLs · The Verge
What each outlet adds
beyond the shared facts- Ars TechnicaLists exposed items, including a partial bank-account number.
- The VergeNames Tracy Clayton on the pause and Singleton on the fix.
- Cyber Security NewsGives the October 8 bounty date and failed rechecks of 40 links.
- WIREDSays cofounder Asaf Aprozper’s LinkedIn outreach got no reply.
- GBHackersReports Claroc found no evidence the exposed shares were misused.
Coverage
oldest first · one row per article · UTC- · 5d ago
Ars Technica · SecurityFirst report
Meta Muse share links expose private chats via passive DNS
Claroc enumerated 6,800 links because every share hostname is under cf.metaaiusercontent.com and includes the chat title.
- · 5d ago
The Verge · AI
Meta pauses Muse share links after chats found on the web
Claroc rebuilt more than 6,800 Muse share URLs from public DNS records, exposing business and personal chats.
- · 4d ago
Cyber Security News
Meta pauses Muse sharing after chat links leak via DNS
Passive DNS preserved secret share hostnames, so finders could open pages without an account or a bypass.
- · 4d ago
GBHackers
Meta suspends Muse sharing after GhostShares DNS link discovery
Claroc recovered more than 6,800 share hostnames from passive DNS; sampled pages included budgets and business documents.
- · 4d ago
WIRED · Security
Muse share links expose private chats through DNS-visible names
Claroc enumerated 6,800 links from passive DNS; Meta has paused sharing while it reviews the report.
- · 3d ago
Meta re-enables Muse sharing after replacing exposed artifact URLs
Old shared-artifact links now ask visitors to request a new URL from the person who shared them.