What was reported and what Meta changed
Meta's Muse assistant shared a conversation by publishing it as a web page that anyone with the link could open, with no login required. The problem, according to a research post by the security firm Claroc, is that the links were also easy to find without ever being sent one. Muse built each share address from the conversation's own title, followed by a random identifier. Claroc reports that when a share is opened, the hostname can be observed by DNS sensors that feed commercial passive-DNS services, and that those services may retain the full hostname, title included, in a searchable dataset. The firm says it searched one such dataset for hostnames under the content domain Muse serves shares from and found more than 6,800 after filtering scan noise. It opened only a few hundred, without any account, during an October 7 to 8 collection window, and says most pages were harmless. A minority were not: the firm describes finding a small-business loan application, a revenue review marked for one company's chief executive, and a job candidate's confidential notes. The 6,800 figure counts discoverable hostnames, not proven sensitive conversations.
The development on October 20 is Meta's response. After Ars Technica asked about the findings, a Muse spokesperson confirmed to Ars Technica and to The Verge that the company paused the sharing functionality while it reviews the report. Claroc says it reported the findings to Meta's bug bounty program on October 8, that it has no evidence of misuse, and that when it rechecked 40 previously reachable shares on October 20 none opened, although the hostnames remain in passive-DNS history. The reporting does not state an exact pause time, so this article describes a verified company response rather than a confirmed breach.
Why the address design mattered more than the random identifier
The technical detail worth understanding is where the identifying information lived. DNS resolution is a normal step in loading any web page, and it does not by itself place a hostname in a publicly searchable index. What matters is that passive-DNS operators run resolvers that can observe lookups made through them, and commercial datasets built from those observations may retain the full hostname afterward. In the Muse design, that retained hostname carried the conversation title, so a list pulled from such a dataset read like a catalog of page contents. The random identifier was not the weak point; the discoverable full hostname, combined with pages that opened without authentication, made a private link findable.
Sharing features in other AI products have produced similar incidents. Claroc's post points to shared ChatGPT conversations surfacing in Google results in 2025 and to Google later indexing hundreds of thousands of Grok conversations. What distinguished the Muse case, in the researcher's account, was the channel: the conversation title inside the web address, combined with hostname retention in DNS datasets, rather than search-engine indexing. Meta's share pages asked crawlers to stay away through robots.txt, but that instruction governs crawling, not access, and the discovery path Claroc describes did not involve a search engine. For a business, the analytical point is that exposure can arise from how an address is constructed and recorded rather than from any sharing switch a user can see.
What this means for your business
If your staff use AI assistants at work, the practical question is not whether that particular vendor fixed its links. It is what happens every time someone asks an assistant to share a conversation. A share link can make an internal discussion public. A concrete system Detailed In Design could build for a business is a small internal sharing gate: a custom web portal, built as needed for your team, where employees would post AI-prepared summaries, proposals, or reports behind authenticated accounts, with recipient permissions, link expiration, access logging, and a human review step before anything is released outside the company. Built that way, the portal would keep descriptive titles out of hostnames and check access at the page rather than relying on an unguessable address. Such a portal would not repair a third party's consumer product, could not remove data already recorded in public DNS history, and would do nothing if staff kept using vendor share links instead of the approved route.
Two habits are worth adopting. First, treat an AI share link as an outbound transfer of everything in that conversation, and say so plainly in your AI usage guidance. Second, ask who inside the company is using consumer AI assistants without an approved rollout, and what those tools are being asked to share. Detailed In Design can help you document which tools your team relies on and where their output is allowed to go, and we also build and maintain business websites and reviewed local workflow automations. We do not claim any partnership with Meta or Claroc, any proprietary security product, or any guarantee that a portal prevents every data leak.
Sources and original reporting
- Claroc Research Team. (2026, October 18, updated October 20). GhostShares: A shared Muse chat exposed prep for a confidential call with a frontier AI lab leader. Claroc Blog. https://blog.claroc.io/ghostshares-muse-passive-dns/
- Roth, E. (2026, October 20). Meta pauses Muse sharing after researchers find AI chats on the web. The Verge. https://www.theverge.com/tech/1014627/meta-muse-ai-sharing-ai-chats
- Goodin, D. (2026, October 20). Meta Muse exposes users' personal and business secrets when they share conversations. Ars Technica. https://arstechnica.com/security/2026/10/meta-muse-exposes-users-personal-and-business-secrets-when-they-share-conversations/
Share this story
Use More apps or Copy link for Instagram, Threads, YouTube, and other platforms.