Meta Muse AI Shared Chats Exposed Business Data Through Passive DNS

Meta has switched off conversation sharing in its Muse AI assistant after security researchers showed that "private" share links could be rediscovered by anyone with access to passive DNS history. Some of those pages held confidential business material: revenue reviews, loan applications and financial reports.

What happened

When a Muse user shared a conversation, the page was published on its own subdomain under cf.metaaiusercontent.com. Each hostname combined a readable version of the conversation title with a random identifier. On its own, that identifier made a link hard to guess.

The weak point was DNS. Whenever someone opened a shared link, their resolver looked up the full hostname, random part included. Passive DNS services record lookups like these and keep them, which turned a list of "secret" links into something searchable. Researchers at Claroc, who named the issue GhostShares, rebuilt working links from those records without guessing passwords, compromising accounts or bypassing any control.

A few details matter:

• This was a design weakness, not an attack. No malware was involved and the researchers report no evidence of misuse.
• robots.txt didn't help. Telling search and AI crawlers to stay away doesn't stop DNS records from being stored or pages from being opened directly. The researchers also found more than 75 saved scans of Muse share pages on a public URL-scanning service, which is a second way to find them.
• The scale is unclear. After filtering out noise, the researchers counted over 6,800 share hostnames but opened only a few hundred pages. That figure is a count of hostnames, not of confirmed sensitive conversations.

Most of the pages they reviewed were harmless. A minority were not: a CEO-facing revenue review, a small-business loan application, an investor's financial report, a bank fraud alert with partial account details, a staff vacation calendar, and preparation notes for an executive-search call that included an internal contact and a meeting time.

The issue was reported to Meta's bug bounty program on 8 October 2026. On 20 October Meta paused the sharing feature while it reviews link discovery. Previously reachable shares now return errors. Historical DNS records still contain the hostnames, and the conversation titles inside them.

Why it matters

This follows a pattern seen with other AI assistants: people treat a "share" button as private collaboration, when in practice it publishes the conversation. With Muse, the route to discovery was infrastructure rather than search-engine indexing, so the usual protections (noindex tags, crawler rules) didn't apply.

Even with the pages offline, leaked titles such as "Q3 revenue review" or "team offsite plan" are useful to an attacker. They show who is working on what, and that is good material for convincing phishing, impersonation or invoice-fraud pretexts. The sample can't show how long pages stayed reachable or whether anyone else opened them, so the full exposure is still unknown.

What to do

1. Find out who uses Muse and other consumer AI assistants for work. Check whether any business conversations were shared, and treat anything that was as potentially exposed.
2. Tell staff plainly that a public link isn't limited to the people you sent it to. Anyone who finds the link can read it.
3. Treat share creation as an outbound data transfer. Monitor it the way you would a file upload to a personal cloud drive.
4. Block when you can't control it. Where you have no adequate controls, block muse.ai and metaaiusercontent.com through your managed proxy or DNS filtering.
5. Assume titles have leaked. If a sensitive project or deal appeared in a shared conversation title, brief the people involved to watch for targeted phishing or pretexting.

Exposures like this sit outside your own perimeter, in third-party platforms, DNS history and public scan archives, which is where traditional tools rarely look. Our Attack Surface Management service continuously maps what the internet can see about your organization, including subdomains, exposed services and public traces like these, so your team hears about it before an attacker does.

Research credit: Claroc (GhostShares). Originally reported by Cyber Security News.