Meta Muse AI Privacy Flaw Exposed Confidential Business Data via Shared Links
Meta has paused its Muse AI conversation sharing feature following the discovery of a privacy flaw that exposed confidential business data through discoverable chat links.
Meta has temporarily halted its Muse AI conversation sharing feature after researchers uncovered a significant privacy flaw that could expose confidential business data and personal details through publicly discoverable chat links. The vulnerability, identified by researchers at Claroc, affected pages that users had explicitly chosen to share, not all private Muse conversations. Crucially, any individual who stumbled upon an affected link could access its contents without requiring authentication.
The issue stemmed from the way Muse constructed its shared page addresses. Specifically, conversation titles and random identifiers were incorporated into the hostnames of shared pages. These hostnames were subsequently recorded by passive DNS services, which log observed domain lookups. This mechanism provided an indirect pathway for unauthorized individuals to discover and access shared pages, bypassing the need to receive a direct link from the page owner.
Claroc researchers dubbed the exposed pages "GhostShares" and detailed the flaw in a report submitted through Meta's bug bounty program on October 8, 2026. They emphasized that this was a design weakness in the sharing functionality rather than evidence of malware or a confirmed attack. The shared content was hosted under the domain cf.metaaiusercontent.com, with each share's hostname comprising a readable conversation title alongside a random identifier. While this random ID was intended to make direct guessing difficult, the passive DNS records could preserve the complete hostname, including the supposedly private elements, when participating services observed a lookup.
Unlike previous exposures involving ChatGPT, which were linked to search engine indexing, this discovery relied on DNS history. This meant that standard crawler restrictions, such as those implemented in Muse's robots.txt file, were ineffective in preventing the storage of these DNS records. Claroc also identified over 75 saved scans of Muse share pages on urlscan.io, indicating another potential route for discovery. After filtering out noise, they counted more than 6,800 share hostnames, though they cautioned that this number did not necessarily equate to that many confirmed sensitive conversations, as only a fraction were examined.
Initial investigations by Claroc revealed that a minority of the inspected pages contained sensitive records. Examples included a marketing company's revenue review intended for its CEO, a small business loan application, and a property investor's financial report. Other pages contained a bank fraud alert with partial account details and a staff vacation calendar. The researchers noted that Muse initially loaded minimal content directly, with the full conversation being fetched via JavaScript, meaning a basic page fetch might not reveal the sensitive data.
On October 20, Meta confirmed it had paused the sharing feature and was reviewing the findings to implement necessary changes. Claroc verified that previously accessible shares were no longer available, returning errors. However, the historical DNS records continue to retain the hostnames and titles of these shared pages, highlighting that blocking current access does not erase previously logged information. This situation underscores the broader risks associated with treating public links as secure collaboration tools, especially in business contexts.
Organizations using Meta Muse AI are advised to review employee usage of the feature, verify if any business conversations were shared, and reinforce policies regarding the sharing of sensitive information via public links. Claroc recommends monitoring share creation as a potential outbound data transfer and, where appropriate, blocking muse.ai and metaaiusercontent.com through network controls.