Meta Pauses Muse Chat Sharing After 6,800 Shared Conversations Surface in DNS Records

Meta has switched off the link sharing option in its Muse AI app after security researchers showed that Muse shared chats could be found by anyone who knew where to look. More than 6,800 shared conversations turned up in public internet records, and some of them held loan applications, bank fraud alerts and private business plans. If you or your company has used Muse to share a conversation, this is worth a few minutes of your time.

The story was first reported by Ars Technica and later covered by Engadget, which said Meta paused the feature on October 20. The underlying research comes from Claroc, a security firm that published its findings on its blog under the name "GhostShares."

What happened with Muse shared chats

Muse is the agentic AI platform Meta launched on September 8, 2026. Like ChatGPT and other assistants, it lets you turn a conversation into a link that you can send to a coworker or friend. Anyone with that link can open the chat without logging in.

The problem was in how those links were built. According to Claroc, Muse created a separate web address for every shared chat, and it used the conversation's own title as part of that address, plus a random ID. So a chat titled something like a loan application or a meeting prep note ended up with that title sitting inside a hostname under Meta's content domain.

Hostnames are not private. When a browser opens a link, it asks the internet's domain name system (DNS) where that address lives. Commercial "passive DNS" services quietly record those lookups and let paying customers search them. Claroc said it searched one of those services for addresses under Meta's Muse sharing domain and got back thousands of results. In the firm's words, a single search returned them "listed by name, like a table of contents."

Claroc stressed that it did not guess or brute force anything. The addresses were already sitting in public records. After filtering out noise, the firm counted more than 6,800 share hostnames. It also found more than 75 saved scans of Muse share pages on urlscan.io, a public website scanning service.

What was exposed

Claroc says it opened only a few hundred of the links, but what it saw was sensitive. Its examples included:

• Preparation notes for a confidential executive search call, naming a contact at a frontier AI lab and the meeting time
• A marketing company's internal revenue review prepared for its CEO
• A small business loan application, including the amount requested
• A personal to do list that contained a bank fraud alert with a partial account number, a transaction amount and a time
• A real estate investor's report with two property addresses and income, return and mortgage figures
• A workplace staff vacation calendar

Engadget summed it up as a mix of business and personal uses. Claroc said it is not naming the companies or people involved.

Why this matters

The core lesson is simple. A share link is a public link. Many people treat "share" as if it means "send privately to one person," and that assumption is what turns a convenience feature into a leak.

Muse made things worse by putting the chat title in the address. Even someone who never opens the page can learn a lot from a title alone. And because DNS history sticks around, Claroc pointed out that the titles remain in passive DNS records even after Meta disabled the pages.

This is not the first time AI chat sharing has gone wrong. Claroc noted that in 2025, ChatGPT share links showed up in Google search results before OpenAI pulled that option, and roughly 370,000 Grok conversations were indexed by Google. Muse's version of the problem took a different route (DNS instead of search engines), but the outcome looks familiar.

It also lands at an awkward time for Meta. Muse has been one of the company's biggest AI pushes this fall, following launches we covered like Meta's Muse Wonder frontier model and the open release of Muse Spark.

How Meta responded

Claroc says it reported the issue through Meta's bug bounty program on October 8, 2026, with steps to reproduce it and sample shares. On October 20, after Ars Technica contacted the company, Meta said in a statement quoted by Engadget: "we've paused this functionality while we review this report and consider changes to how these links can be discovered."

Claroc then rechecked 40 of the shares it had found. None opened, and the hostnames returned an error. The firm said it was "glad to see it closed this quickly" and plans to delete its stored discovery data once Meta confirms it has what it needs.

Meta has not said when sharing will return or how the links will work if it does.

Who is affected

Anyone who used the Muse share button between the September launch and October 20 may have created a link that showed up in DNS records. That includes individuals and, maybe more importantly, employees who used Muse for work.

Claroc also cautioned that its count covers only one discovery method and one address pattern over a short window. The firm said its numbers are not a measure of total exposure, so the real figure could be higher.

What to do now

If you used Muse sharing, here are practical steps:

1. Assume the title is public. Even with pages disabled, the conversation titles may live on in passive DNS history. Think about what your titles revealed.
2. Act on anything sensitive. If a shared chat contained account details, contact your bank. If it held work material, tell your security or IT team.
3. Rename before you share anywhere. On any AI app, give conversations bland titles if you plan to share them.
4. Check your other AI apps. Review what you have shared in ChatGPT, Gemini and others. Our guide to ChatGPT locked chats covers one newer privacy option, and our social media privacy checkup walks through the broader settings.

Advice for companies

Claroc's recommendations were aimed at organizations. It suggested finding out who on staff uses Muse, telling employees that a share link is public and that its title becomes a DNS name, watching for public shares, and considering blocks on muse.ai and metaaiusercontent.com at web proxies or DNS filters.

That last step is a judgment call, since some teams may rely on Muse for real work. But a short internal memo explaining how sharing worked costs almost nothing.

What to watch next

The big question is how Meta rebuilds sharing. A common fix is to use one shared domain with an unguessable path, so nothing about the content appears in DNS at all. Expect pressure on Meta to explain whether any links were accessed by others before the pause, and whether it will notify affected users.

Regulators may also take an interest given the financial details involved, though nothing has been announced. For more coverage of privacy and big tech, visit our tech section, and if you want to see what Meta and other platforms already hold about you, read our guide on how to download your data from big tech.

Frequently asked questions

Can people still open my Muse shared chats?

According to Claroc, the share pages it rechecked on October 20 no longer opened after Meta paused the feature. However, the chat titles may still appear in passive DNS history.

How did researchers find the links?

Claroc searched a commercial passive DNS service for hostnames under Meta's Muse sharing domain. Because each link used the chat title in its address, the results listed conversations by name.

Did Meta say users would be notified?

Meta's statement, as quoted by Engadget, only said it paused the feature while reviewing the report and considering changes. It did not mention notifications.

Should I stop using Muse?

That is your call. The exposure involved the sharing feature, not private chats you never shared. If you keep using Muse, avoid putting sensitive details in conversations you plan to share and use neutral titles.