Meta has suspended the conversation-sharing feature in its Muse AI assistant after security researchers demonstrated that share links could be discovered en masse through public DNS records. The researchers, from security firm Claroc, enumerated 6,800 links that Muse users had created to share conversations, searches and images, and found confidential material that was never intended to be public.

A design choice that made links findable

Share features typically rely on long, unguessable URLs to keep sensitive content away from unintended recipients. Muse appeared to follow that pattern, but the architecture of its links undermined the protection. Every share link used the domain cf.metaaiusercontent.com, and the conversation title was placed in the subdomain rather than in the URL path. That meant a link for a revenue review might resemble q3-revenue-review-7b1e42f0.cf.metaaiusercontent.com, with the subject of the conversation sitting in plain sight ahead of the random string.

Because the title lives in the subdomain, it is recorded in public DNS. Passive DNS services, which store historical mappings of domain names to IP addresses and are widely available commercially, capture those records once a link is opened. A single query against such a service was enough to surface thousands of share pages. Claroc calls them GhostShares: pages that open for people who were never handed the link and who can find them independently.

What the researchers found

After opening a few hundred of the enumerated links, Claroc reported content that clearly belonged behind closed doors. Among the examples: a candidate's notes preparing for a confidential executive-search call with a frontier AI lab, including the lab's internal contact and the meeting time; a national marketing company's internal revenue review marked for its CEO; a small-business owner's loan application with the requested amount; a to-do list containing a bank fraud alert with a partial account number, transaction amount and time; a real-estate investor's performance report with two property addresses and exact return, income and mortgage figures; and a workplace's full-year staff vacation calendar listing dozens of employees by week.

"If you had asked us beforehand, we would have guessed that gathering these would take real effort," the researchers wrote. "It took one query." Claroc co-founder and CTO Asaf Aprozper said he reported the findings through Meta's bug bounty program on October 8 and also tried to reach Meta staff on LinkedIn, receiving no reply through either channel.

Meta pauses sharing

Meta confirmed it is suspending the feature while it reviews the report. The company said it opened the Muse bug bounty program so researchers could raise different scenarios and help improve the product, and that people can share specific Muse artifacts, which creates a page accessible to anyone with the link. It said it has paused that functionality while it considers changes to how links can be discovered. The suspension removes this particular exposure for Muse users, at least for now.

Trust and the cost of broad access

The disclosure lands awkwardly for a product marketed heavily on security. Meta CEO Mark Zuckerberg said last month that Muse was "built from the ground up for privacy and security," and the assistant quickly climbed to the top of Apple's App Store. Muse autonomously fills out forms, books appointments, makes purchases and creates documents, capabilities that require access to most of a user's accounts. That breadth of access is precisely what makes link-level leaks consequential: conversations with an agent that can see email, calendars and financial accounts are likely to contain material users would never post publicly.

The episode follows an earlier security controversy. Three weeks after launch, macOS security expert Patrick Wardle found a zero-day vulnerability that let any other app on the same device take complete control of a user's Muse account. Meta downplayed the severity, arguing exploitation required an already-compromised device, and did not acknowledge Wardle's finding that a simple ClickFix attack was sufficient to hijack an account. The ease of discovering share links adds to the questions about whether Muse is worthy of the access it demands. For developers building agentic systems, the lesson is that share-link design is a security boundary: putting human-readable titles into DNS-visible subdomains turns a private link into a searchable index entry.