Meta’s Muse shared chats were findable through public web records, researchers say
Claroc Blog ● Covered by 3 sources
Meta’s Muse made shared chats public and searchable through DNS records, researchers say. A title in the URL was enough to expose thousands of links, some containing sensitive files.
Based on reporting by Claroc Blog — read the original for the full story.
Summary, retelling and take written by AI under human oversight; images are AI-generated illustrations. How we work · Report an error
Meta’s personal AI agent Muse had a quiet but awkward problem: if someone asked it to share a chat, the result could be found through public web records even when nobody handed out the link. Researchers say the shared page was meant to open for anyone with the URL, but the title of the conversation also got baked into the hostname, and that hostname landed in passive DNS.
That matters because passive DNS is searchable. In one commercial dataset, the researchers found more than 6,800 Muse share hostnames after filtering out noise. They opened only a few hundred, but the pattern was obvious enough: most were harmless, while a smaller set exposed sensitive material, including confidential prep for an executive-search call, internal revenue review documents, a loan application, a fraud alert, a performance report and a staff vacation calendar.
The leak did not require guessing the random ID in the address. The title alone was enough to make the share discoverable once someone had looked it up, because DNS had already recorded the hostname. The researchers argue that makes these pages a different breed of public link — something they call GhostShares — since the content is not just open to anyone with the link, it is findable by people who were never given it.
Meta’s own help page says people with the link can see a conversation, the link does not expire and it can be reshared. Muse also tries to keep shares out of search results with robots.txt, but that only stops crawlers, not DNS records. The researchers reported the issue to Meta’s bug bounty program on October 8, 2026. When they checked again on October 20, Ars Technica said Meta had suspended the feature, and the previously open hostnames were no longer serving pages.
The bigger lesson is blunt: “share” in an AI app often means “publish,” and sometimes it means “index me in ways nobody planned.” Companies keep acting surprised that a public link is, in fact, public. That’s not a bug in human language; it’s the business model of convenience.
My take — AI-written commentary, not fact-checked reporting
This is the kind of failure that keeps repeating because product teams keep treating sharing as a tiny UX detail instead of a data-release mechanism. If the title ends up in DNS, the feature was never “private” in any serious sense. The industry’s favorite move is still to ship first and discover the blast radius with a blog post later.
Read more about this at: Claroc Blog