Meta has paused the share feature in its Muse AI assistant after security firm Claroc found shared chat pages through public DNS records. Meta's Muse spokesperson, Tracy Clayton, said in a statement to The Verge that sharing is paused "while we review this report and consider changes to how these links can be discovered."
How the links were found
A Muse share is a web page that opens for anyone with the link, with no login. Claroc's report says Muse builds each share's hostname from the chat's title plus a random ID, under cf.metaaiusercontent.com.
Passive-DNS tools log hostnames that browsers look up. Because the hostname carries both the title and the ID, Claroc says a hostname pulled from those records rebuilds the working link. The random ID no longer works as a secret.
Claroc says one commercial passive-DNS service listed more than 6,800 share hostnames about a month after launch. It also found more than 75 saved scans of Muse share pages on urlscan.io.
What was inside
Claroc opened a few hundred pages while logged out. Most were harmless, it says, such as small-business pages, listings and event calendars. A minority held personal or internal material.
Examples it describes, without identifying anyone, include a small-business loan application, a marketing company's revenue review marked for its CEO, a full-year staff vacation calendar, and a call-prep note for an executive-search interview. It also found a to-do note with a bank fraud alert and a partial account number.
Claroc reported the issue to Meta's bug bounty program on October 8. It says it has no evidence anyone misused the pages, and that it cannot know how long any share was reachable or who else found it.
Search engines were not the route
Muse's robots.txt asks search crawlers to stay away from share paths, per Claroc. That governs crawling, not access, and this discovery route never used a search engine.
Claroc's Oct. 20 update says that after Ars Technica asked Meta about it, Meta told Ars it is suspending the feature. Claroc then rechecked 40 shares that had opened without an account earlier. None opened, and their hostnames returned an error.
The hostnames, titles included, remain in passive-DNS history.
What to do
Treat a Muse share link as publishing the chat. Claroc's advice is to assume anything you share is public until you have checked. Claroc's capture of Meta's help page for Meta AI says people with a link can see the conversation, and links do not expire.
For companies, Claroc suggests telling staff that a share link publishes the conversation. If you cannot monitor shares, it suggests blocking muse.ai and metaaiusercontent.com on managed devices, which also blocks Muse itself.
If you used Muse for work or money matters, think about what any link you created contained. We could not confirm whether Muse offers a way to list or delete old shares.
What is not known
Meta has not said whether or when sharing returns, or what "changes to how these links can be discovered" will be. Claroc's count covers one discovery channel and one hostname pattern, so it is not a measure of total exposure.
This is not the first AI chat-sharing feature to expose conversations. For more on Meta's assistant, see Muse Spark Open and what it takes to run it and Muse Wonder: access, price and data.
