A single DNS query was enough to uncover thousands of Meta Muse conversation-sharing links, including some that exposed sensitive personal and business information.
Researchers at cybersecurity firm Claroc have uncovered a flaw in Meta's new AI platform, Muse, that could expose users' sensitive information, identifying more than 6,800 conversation-sharing links through passive DNS records.
After opening several affected pages, the researchers found conversations containing personal financial details, bank-fraud alerts, and confidential business reports, all accessible without signing into a Muse account.
The discovery prompted Meta to suspend the sharing feature while it reviews the issue. Although Claroc reported no evidence of misuse, the findings show how a feature designed to make AI conversations easier to share can also expose sensitive information to unintended audiences.
A link was all it took
According to Asaf Aprozper, Claroc's co-founder and CTO, the firm reported the issue to Meta's bug bounty program on Oct. 8 but received no response. Aprozper also tried reaching the company through LinkedIn, Ars Technica reports.
While Meta has touted Muse as built with security in mind from the ground up, the discovery showed how easily its conversation-sharing feature could expose sensitive information. Claroc researchers found that a single query against a commercial passive DNS service was enough to identify more than 6,800 sharing links, and they examined hundreds of them.
Explaining how it worked, Claroc said Muse generated each shareable web address using the conversation's title, followed by a random identifier, under the domain cf.metaaiusercontent.com.
When a shared conversation's hostname is resolved through DNS, that lookup can be observed and recorded by passive DNS systems. Commercial passive DNS databases aggregate these records, potentially making previously accessed hostnames discoverable to researchers or other subscribers.
The random identifiers were intended to make the links difficult to guess. But once complete hostnames appeared in passive DNS records, that protection no longer prevented someone with access to the records from finding and opening the associated pages.
Claroc calls these exposed pages GhostShares: conversations users shared through links that people without those links could also discover.
The researchers found a range of sensitive material, including a small-business owner's loan application, a company's internal revenue review, a bank-fraud alert, and notes preparing a candidate for a confidential call with an AI laboratory.
Claroc did not publish the query, for obvious security reasons.
AI conversation-sharing risks extend beyond Muse
Meta has since suspended Muse's sharing feature. Claroc reported that 40 previously accessible pages it rechecked no longer opened, although their hostnames remained in passive DNS history.
Other AI platforms have faced different problems involving shared conversations. In July 2026, WIRED reported that some publicly shared Claude conversations appeared in Google and Bing search results. The pages reportedly lacked a noindex directive, despite Anthropic using robots.txt to discourage crawling.
WIRED reported that the shared pages lacked a noindex directive, which tells search engines not to include a page in their results, even though Anthropic used robots.txt to instruct crawlers not to access the pages.
OpenAI faced a similar but distinct issue in July 2025, when shared ChatGPT conversations became discoverable through search engines during an experiment that let users opt in to making their chats searchable. OpenAI subsequently removed the feature, acknowledging that it had created too many opportunities for users to share content unintentionally.
Although the technical mechanisms differed, the incidents point to a recurring problem: a conversation intended for a limited audience can become far more accessible than its owner expects.
What users and security teams should do
For users, the immediate lesson is to avoid creating shareable links for AI conversations containing sensitive personal, financial, or business information. A link that appears difficult to guess should not automatically be treated as private.
If you must share a conversation, treat your AI conversations as potentially sensitive records, particularly when they contain financial information, internal business documents, personal details, or confidential plans.
Before sharing a chat, review what it contains and who will be able to access it. Removing a sharing link or turning off a feature may not erase copies or historical records already collected elsewhere.
As AI tools become part of everyday work, their security must extend beyond reducing prompt injection attacks and preventing account breaches to ensuring that the information users entrust to them does not reach unintended audiences simply because they chose to share a conversation.
The Muse discovery shows that protecting AI conversations requires more than preventing account breaches or prompt injection attacks. Even a randomly generated sharing link can expose sensitive information if the systems surrounding it make that link discoverable.
Other news: Microsoft's October 2026 Windows Server security updates have caused email disruptions for some on-premises Exchange deployments, including failed webmail access and delayed message delivery.