Meta pauses Muse chat sharing after 6,800 links surface

Hitting "share" on an AI chat can mean publishing it to anyone who knows where to look.

That is what security firm Claroc says happened with Meta's Muse. In a report, Claroc says it found more than 6,800 shared Muse conversations by searching public DNS records, and that almost every live one it opened loaded without an account. Meta has paused the feature.

The links were listed in public DNS

Muse, Meta's agent platform, launched on Sept. 8. When you share a conversation, Claroc says, Muse publishes it as a web page at its own subdomain under cf.metaaiusercontent.com, named from the conversation's title plus a random ID.

Hostnames like that end up in public DNS records. Passive DNS tools collect those records and let anyone search them.

So nobody had to send you the link. You could look up the list of shares, titles included, and rebuild the addresses yourself. Claroc also found more than 75 Muse share pages saved on urlscan.io.

The count that matters:

More than 6,800 share hostnames, after Claroc filtered out scan noise.

Claroc says it opened only a few hundred, in a logged-out browser. Most were harmless. Some were not. Claroc describes a candidate preparing for an executive search call with a frontier AI lab, a company's CEO-only revenue review, a small business loan application, a to-do list with a bank fraud alert and a partial account number, a real estate investor's performance report and a company's staff vacation calendar.

Claroc says it reported the issue to Meta's bug bounty program on Oct. 8. After Ars Technica reported the findings on Oct. 20, Meta told Ars, according to Engadget: "we've paused this functionality while we review this report and consider changes to how these links can be discovered." Claroc says that when it rechecked 40 shares afterward, none opened.

Unguessable is not the same as private

The random ID in each address was meant to keep links private. It didn't, because the address itself was published to a system built to be read by anyone.

Meta did respond fast once the story ran, and the links Claroc tested no longer open. But the hostnames, with their titles, remain in passive DNS history, according to Claroc. A share titled after a confidential meeting still announces that title in public, even if the page is gone.

This is a design pattern problem as much as a Meta problem. Plenty of AI tools turn a shared chat into a public page. People click share to send something to one colleague. They are publishing it.

What to do if your team uses Muse

Start with the people. Claroc's own advice, which is worth taking regardless of who sells what:

• Find out who on your team uses Muse, and tell them a share link made the conversation public.
• Monitor for public share creation in the AI tools your company allows.
• If you cannot govern the tool, block muse.ai and metaaiusercontent.com at your proxy or DNS filter, as Claroc suggests.
• Search passive DNS and urlscan for the content domains of the AI tools your staff use, and see what is already out there.

Claroc sells security tooling, so read the report with that in mind. The mechanism it describes is simple enough to check yourself.

Then look at your own habits. Before you paste a loan application or a revenue number into any AI chat, decide whether you would be fine seeing its title in a public list.

What to watch

Meta says it is considering changes to how links can be discovered. Watch whether Muse sharing comes back with private links by default, or with a clear warning that a share is public. Then check your other tools' share buttons. Today.