GhostShares: One DNS Search Exposed 6,800 Shared Meta Muse AI Chats, Including Loan Files and CEO Reports

Thousands of conversations shared from Meta's new Muse AI agent could be found and opened by people who were never sent the link, according to research from security firm Claroc.

Claroc says a single search of a commercial passive-DNS database returned more than 6,800 Muse share pages, each listed by its conversation title. A sample it opened without logging in included a small-business loan application, a revenue review addressed to a company's CEO and notes preparing a candidate for a confidential executive-search call with a frontier AI lab.

Claroc published the research on October 18, 2026. On October 20, after Ars Technica asked Meta about the findings, Meta told Ars it was suspending the sharing feature, according to Claroc's update.

How did shared Muse chats become discoverable? #

When a user asks Muse to share a conversation, it publishes the chat as a web page that anyone with the link can open, with no login. That part is by design.

The problem, Claroc says, was the address. Muse served shares from hostnames under cf.metaaiusercontent.com, and each hostname began with the conversation's title followed by a random ID. When anyone opened a share, their browser looked up that hostname in DNS, and passive-DNS services that observe those lookups recorded and stored it.

That turned the random ID, which was meant to make the link unguessable, into a public record. Claroc notes that Muse's robots.txt asked search engines to stay away, but that only governs crawling, not access, and its discovery never touched a search engine.

Claroc calls these pages GhostShares. Muse launched on September 8, and Claroc ran its search about a month later. After filtering out noise, more than 6,800 share hostnames remained. "It took one query," the researchers wrote. They also counted more than 75 saved scans of Muse share pages in a public URL-scanning service.

What sensitive data was exposed? #

Claroc says it opened only a few hundred pages and that most were harmless, such as small-business sites and event calendars. A minority were sensitive. It described six by category only:

• a candidate's notes for a confidential executive-search call with a frontier AI lab, naming the lab's internal contact and the meeting time
• a national marketing company's internal revenue review marked for its CEO
• a small-business owner's loan application, including the amount requested
• a to-do list with a bank fraud alert showing a partial account number and a transaction amount and time
• a real-estate investor's performance report with property addresses and income and mortgage figures
• a workplace's full-year staff vacation calendar listing dozens of employees

Claroc says it withheld every identifier and has no evidence that anyone misused the shares. It also stresses that this is not evidence that private Muse conversations leaked: the issue affected conversations users chose to share.

What has Meta done? #

Claroc says it reported the issue to Meta's bug bounty program on October 8. According to eSecurity Planet, citing Ars Technica, Claroc CTO Asaf Aprozper said the report got no response and he also tried contacting Meta through LinkedIn.

After Ars Technica's inquiry, Meta said it was suspending the feature. When Claroc rechecked 40 shares on October 20 that had opened earlier in the month, none opened. However, the hostnames, titles included, remain in passive-DNS history, which Meta cannot erase. Claroc also says it saw new share hostnames still appearing, 27 on the last day it looked, which it describes as continued discovery rather than confirmed access.

AppSecNews could not independently open the Ars Technica report; Meta's statement is attributed here to Claroc's update and eSecurity Planet's account of that report.

Is this a problem unique to Meta? #

No. Claroc points to similar exposures of shared AI conversations at other providers: shared ChatGPT conversations surfacing in Google results in 2025, and Google indexing more than 370,000 Grok conversations. The mechanism differs, but the lesson is the same: an unlisted link is not a private one.

What should users and security teams do? #

1. Assume shared AI chats are public. Don't share conversations that contain personal, financial or confidential business information, and treat any share link as a publication.
2. Assume titles already leaked. If you shared a Muse chat, treat its title as public, since it may remain in passive-DNS records.
3. Find shadow AI use. Muse needs no admin rollout. Check whether staff are using muse.ai and creating public shares that include company data.
4. Update AI usage policies. Explain what a share link does, alongside rules on what may be pasted into an assistant.
5. Block if you cannot monitor. Claroc suggests blocking muse.ai and metaaiusercontent.com on managed devices until you have visibility.
6. Check your other tools. Search passive-DNS and URL-scan services for the content domains of the SaaS and AI tools your staff use, and create a test share to see what lands in the URL.