Muse's Share Button Turned Private Chats Into Searchable Web Pages

Muse's Share Button Turned Private Chats Into Searchable Web Pages

A shareable link that needs no login and shows up in DNS logs

Meta's new general-purpose AI agent, Muse, exposes sensitive information when users share conversations through web links, researchers reported on Monday. Security firm Claroc said in a blog post that a single search of public DNS records located more than 6,800 links to conversations shared through Muse. Claroc opened a few hundred of the pages without an account or login. Most were harmless, such as small-business sites, listings and event calendars. A minority held dozens of personal records and internal business documents.

GhostShares: conversation titles baked into the address

The problem is URL construction. Every Muse share uses the domain cf.metaaiusercontent.com, and each address combines the conversation name with a long string of text. Simplified examples cited by the researchers look like home-sale-budget-9f21c8a3, q3-revenue-review-7b1e42f0 and loan-application-draft-a4c9e2. Because the title sits inside the web address, public DNS records it for anyone to search. Plenty of AI assistants share by public link, Claroc said. What makes Muse's shares easy to find is the title in the address. It calls the result GhostShares: pages that open for people who were never handed the link, and that those people can find on their own.

From interview prep to loan files, the exposed details were concrete

The files Claroc described were not hypothetical. Among them were one candidate's notes prepping for a confidential call with a frontier AI lab, which named the lab's internal contact and the time of the meeting. Others were an internal revenue review addressed to the CEO of a national marketing company, a loan application from a small-business owner, and a to-do list containing a bank fraud alert that displayed part of an account number. The firm also found a report on a real-estate investor's performance that gave the addresses of two properties along with precise financial figures, and a workplace calendar that named dozens of employees next to the weeks they would be on vacation.

Pitched as private by design, now defended as working as intended

The findings undercut Meta CEO Mark Zuckerberg's claim last month that Muse was built from the ground up for privacy and security. The assistant rose quickly to one of the top spots in Apple's App Store. It can fill out forms, book appointments, make purchases and create documents, and to function as intended it needs access to most of a user's accounts. Claroc researcher Asaf Aprozper said his company contacted Meta and never received a reply. After checking similar platforms, consulting with industry colleagues, and re-reading Meta Muse documentation, he concluded the behavior is by design. His advice was blunt: when requesting Muse to share a chat, it creates a public link discoverable through passive-DNS techniques, so limit personal information in conversations and delete links as soon as possible.

A wider pattern of over-sharing, and what users should do next

The share-link issue follows a separate late-September incident in which Muse gave a Facebook Marketplace shopper the home address of a Toronto man, YouTuber Matt Robb, and booked a nighttime pickup he never approved. Robb later traced the disclosure to an always-allow permission granted when he put the agent in charge of his Marketplace profile. Together, the cases point to the same lesson: Muse is most useful when it holds broad context, and most risky for the same reason. Until Meta adds granular privacy controls or a user-facing opt-out from the indexing that powers discovery, users should keep loan, banking, property and personnel material out of Muse chats, audit old share links, and delete anything sensitive without delay.