Meta pauses Muse sharing after privacy flaw exposed 6,800 conversations
Meta disabled the conversation-sharing feature of its Muse AI assistant after security researchers discovered that more than 6,800 shared conversation links were publicly accessible on the internet. The vulnerability, dubbed "GhostShares" by security firm Claroc, exposes a fundamental problem in how one of the company's most ambitious products was built.
What happened
Muse launched on September 8, 2026 as Meta's general-purpose AI assistant, positioned by CEO Mark Zuckerberg as "built from the ground up for privacy and security." The product gained rapid traction, hitting 10 million downloads in the United States in just 40 days — a milestone reached by only 11 other apps. The company invested heavily in promotion, with Zuckerberg appearing in interviews defending Muse as different from competitors like ChatGPT by running on an isolated cloud virtual machine for each user.
The feature that drew criticism allowed users to share their conversations with Muse via unique links. The feature did not require login to access, which is not unusual for web sharing services — Gmail, Google Docs, and even collaboration tools like Notion work the same way. The problem lay in how Muse constructed those web addresses.
Each share link followed the structure `conversation-title-random-id.cf.metaaiusercontent.com`. The domain was always the same, but what made the links discoverable was the fact that the conversation title appeared directly in the URL. When someone clicked one of these links, the DNS record was logged in commercial passive-DNS databases that store all domain resolutions ever observed on the internet.
The Claroc team performed a single query against a commercial passive-DNS service for the domain `cf.metaaiusercontent.com` and, after filtering out wildcard DNS scan noise, found more than 6,800 share hostnames. Opening a few hundred of these links, researchers confirmed that the vast majority accessed content without requiring any authentication.
What was exposed
Among the conversations Claroc accessed, the researchers found sensitive data that was clearly not intended for external audiences: an internal performance report from a real-estate investor containing property addresses and exact return values, a marketing company's revenue review, a small business owner's loan application, and a workplace calendar listing dozens of employees against the weeks they would be absent.
A simplified example of an exposed URL would be: `q3-revenue-review-7b1e42f0.cf.metaaiusercontent.com` — where "q3-revenue-review" is the conversation title, visible to anyone searching in passive DNS. Another: `loan-application-draft-a4c9e2.cf.metaaiusercontent.com`.
Claroc said it refrained from publishing all identifiers, titles, and specific links in its report, so that nothing pointed directly at the affected content. The firm also stated it did not log in, did not fill out forms, and did not upload anything to any systems accessed. The discovery was reported to Meta's bug bounty program on October 8, 2026, with reproduction steps and share examples.
Meta's response
In response to questions from Ars Technica about the behavior, Meta confirmed it was suspending the sharing feature while it reviewed the problem. When rechecking 40 share links on October 20 that had earlier opened without accounts, none of them accessed content anymore — the hostnames returned errors. However, the hostnames themselves, with conversation titles included, remain in passive-DNS historical records.
Muse spokesperson Tracy Clayton stated: "We've paused this functionality while we review this report and consider changes to how these links can be discovered." The company also updated its Muse Privacy and Security documentation to reiterate that each cloud virtual machine is isolated, that Muse does not share conversations or virtual-machine data with Meta's advertising systems, and that credentials for connected apps sit in a Secure Credentials Store.
Why this matters
The GhostShares vulnerability touches on sensitive points about the trust users are placing in AI assistants increasingly integrated into their daily lives. Muse is not just a chatbot — it has access to users' calendars, emails, and documents, operating as an agent that can perform actions on their behalf. Meta's own privacy document states that "people with the link will be able to see your conversation," that "the link does not expire," and that "people can share the link onward."
What makes this case particularly problematic is the nature of the discovery. No social engineering, phishing, or traditional vulnerability exploitation was required. A single query to a commercial passive-DNS service was sufficient. Muse's robots.txt asks search engines and AI agents to stay off the share paths, but robots.txt governs crawling, not access, and Claroc's discovery never went near a search engine.
This is not the first security issue involving Muse in its six weeks of existence. Earlier in October, security expert Patrick Wardle found a zero-day vulnerability that allowed other applications to take full control of a user's Muse account — Meta downplayed the incident at the time. Now, with GhostShares, the company again failed to respond to researchers before journalistic contact.
The security community is drawing attention to a broader question: no other leading AI service has faced a vulnerability of this scale related to sharing. ChatGPT and Gemini use different sharing mechanisms that do not expose conversation titles in URLs. The Muse case raises questions about how Meta tested its product before launching at scale, especially considering that Zuckerberg positioned Muse as "built from the ground up for privacy and security" in his promotions.
What is clear is that, as AI assistants become central to managing personal and business information, every new sharing feature needs more rigorous security audits than the traditional ones. A "share" button that seems harmless can, in fact, turn private conversations into a public directory accessible to anyone with access to a passive-DNS service — and the only barrier between a business secret and worldwide exposure was a URL design error.
Sources: The Verge, Unite.AI, Atlabyte
✓ Independent sources cross-checked and verified before publishing
