Muse Share Links Exposed Private Conversations Through Searchable DNS Records

Muse’s share-link design made conversations discoverable to people who were never given the links, according to researchers at security firm Claroc. The team identified 6,800 links and, after opening a few hundred, found private personal and business material. Meta has paused the sharing feature while it reviews how the links can be found.

The exposure hinged on where Muse placed conversation titles in its web addresses. The links used the shared domain cf.metaaiusercontent.com, with each conversation’s title embedded in a subdomain. That structure left titles visible in passive DNS records, which can be collected and searched by commercial services. A long string of text in each link may make it hard to guess an individual URL, but it doesn’t prevent researchers from finding links through DNS data.

What researchers found

Claroc said it enumerated 6,800 Muse links. Among the few hundred pages it opened, researchers encountered material that appeared intended for a limited audience, including notes for a confidential executive-search call with a frontier AI lab, an internal revenue review marked for a company CEO, and a small-business owner’s loan application.

Other examples included a to-do list mentioning a bank fraud alert and partial account details; an investor’s report with property addresses and financial figures; and a workplace calendar listing employees’ planned vacation weeks. The findings show how a share feature meant to pass a conversation to a chosen recipient can expose more than the user expects when its links become searchable.

“If you had asked us beforehand, we would have guessed that gathering these would take real effort,” Claroc’s researchers wrote. “It took one query.”

Claroc cofounder and CTO Asaf Aprozper said he submitted the findings through Meta’s bug bounty program on October 8. He also tried to contact people at Meta through LinkedIn, he said, but received no response either way.

Why the links were discoverable

Passive DNS services preserve records of domain names resolving to IP addresses, along with nameserver and mail-server information. Monitoring systems gather those records when they observe DNS responses. When someone follows a Muse share link, that activity can leave DNS information that later appears in searchable databases.

The shared domain gave researchers a common starting point. The subdomain then supplied a conversation title, alongside a string of characters. Claroc’s simplified examples included home-sale-budget-9f21c8a3.cf.metaaiusercontent.com, q3-revenue-review-7b1e42f0.cf.metaaiusercontent.com, and loan-application-draft-a4c9e2.cf.metaaiusercontent.com.

The title’s placement matters: it appeared in the subdomain, rather than in the path after the domain. That made it visible through the DNS records researchers could search. A link can be difficult to guess and still be discoverable through infrastructure that records its domain. The problem Claroc described therefore involved the way the links were organized and exposed in DNS, rather than a need to guess each complete address.

Claroc calls these pages “GhostShares”: pages that open for people who weren’t given the link and can find them independently. The researchers said other AI assistants also let users share content through public links; in their view, Muse’s titles in the web addresses made its shares especially easy to locate.

Meta pauses sharing as scrutiny grows

Meta told Ars that users could share specific Muse artifacts by creating pages accessible to anyone with the link. The company said it had paused the function while reviewing Claroc’s report and considering changes to how links can be discovered. That suspension addresses this particular exposure while the feature is unavailable; the company’s statement did not describe what changes it might make or when sharing could return.

Muse is a general-purpose AI agent that can fill out forms, book appointments, make purchases, create documents and take other actions. Its ability to act across services depends on access to many user accounts, making the handling of information shared through the product consequential for people and organizations that use it.

The share-link report adds to earlier questions about Muse’s access and security. Three weeks after the product launched, macOS security expert Patrick Wardle found a vulnerability that could let another app installed on the same device take control of a user’s Muse account. Meta argued that exploitation required a device to be compromised. Ars reported that Wardle also found a simple ClickFix attack could be enough to hijack an account.

The link issue works through a different route: it concerns discoverability of shared pages, rather than control of an account on a user’s device. Together, the reports make the practical question for Muse users more specific than whether the agent can perform useful tasks: they also need to know how its permissions and sharing features protect the information those tasks may involve. Meta’s review will determine whether the sharing design changes enough to keep links from turning up through public DNS searches.