Image: Unsplash.
Meta has switched off sharing in Muse, its personal AI agent, after a security firm showed that "shared by link" meant something closer to "listed in a public directory." The pages people created to send a chat to a colleague could be found, by title, by anyone with access to a passive DNS dataset. Meta calls the fix a pause. It hasn't said what comes next.
Event date: October 20, 2026 (Meta paused Muse sharing). First reports: October 20, 2026, by Ars Technica at 12:33 UTC and The Verge at 18:07 UTC; WIRED ran the Ars story the next day.
What happened
Muse launched on September 8. A month later, researchers at Claroc searched a commercial passive DNS service for hostnames under cf.metaaiusercontent.com, the domain Muse serves shared pages from. Each hostname was one share, and each one was built from the conversation's own title followed by a random ID. "It took one query," Claroc wrote.
Screenshot: GhostShares research post, Claroc. The titles and IDs in this box are Claroc's made-up examples. Captured October 22, 2026.
The random ID was meant to make links unguessable. It didn't matter. The first time a recipient opens a share, their browser looks up the full hostname, and passive DNS services record that lookup. Claroc's point is blunt: "a hostname pulled from DNS rebuilds the link." The pages then opened in a private browser window, with no Meta account.
Claroc says it opened only a few hundred pages. Most were harmless: small-business sites, listings, event calendars. A minority were not. Among them were a small-business loan application, a revenue review marked for a company's CEO, a workplace's full-year staff vacation calendar with dozens of names, and a job candidate's notes for a confidential executive-search call with a frontier AI lab, down to the meeting time.
Claroc reported it through Meta's bug bounty program on October 8. Asaf Aprozper, Claroc's cofounder and CTO, told Ars he also tried Meta staff on LinkedIn and heard nothing. Meta paused sharing after Ars asked about the findings. "People have the ability to share specific Muse artifacts, which creates a page that can be accessed by those with the link," Muse spokesperson Tracy Clayton told The Verge. "However, we've paused this functionality while we review this report and consider changes to how these links can be discovered."
Screenshot: update note on the GhostShares post, Claroc. Captured October 22, 2026.
Claroc rechecked 40 shares on October 20 and none opened. The hostnames, titles included, are still in passive DNS history, so a title like "loan application draft" stays readable even though the page behind it is gone. Claroc says it has no evidence anyone misused the shares. It also sells a browser extension that flags public AI share links, so read its advice knowing that.
Why the usual precaution didn't help
Every big assistant has had a version of this. ChatGPT, Claude and Grok chats have all turned up in Google Search before, and the standard fix is to keep share pages away from crawlers. Muse did that. When we fetched muse.ai/robots.txt on October 22, it told crawlers to stay off both the /s/ share path and /share.
Screenshot: muse.ai robots.txt, Meta. Captured October 22, 2026.
That file controls search engines. As Claroc puts it, robots.txt "governs crawling, not access," and DNS lookups never touch it. Copies also live elsewhere: an anonymous search of urlscan.io, a public scanning service, still listed 83 saved scans of Muse share pages when we checked on October 22, the newest from October 19. We didn't open them.
This is the second Muse security story in a month. Three weeks after launch, Patrick Wardle found a zero-day that let any other app on the same device take over a Muse account. Muse asks for access to most of a user's accounts, which is why both stories matter more than they would for a chatbot.
Who this applies to
Any team where someone has used Muse for work since September 8. Muse needs no admin rollout, so "we never approved it" isn't the same as "nobody uses it." If you're in the EU or UK and a shared page held customer or staff personal data, it may count as a personal data breach. The UK regulator's line is plain: "If a risk is likely, you must notify us, as soon as possible, and where feasible within 72 hours," per the ICO.
What to do now
- Ask, don't guess. Send one message: who has used Muse, and did you share any chat or artifact? Log the answers in your AI risk register.
- Check what was shared. For each share, note what it held. Customer data, staff data or financials go to your incident response plan for a breach assessment.
- Block it on managed devices if you can't see it. Claroc suggests denying muse.ai and metaaiusercontent.com at the proxy or DNS filter. It's blunt, and it holds until Meta explains the new link design.
- Put share links in your policy. One line covers it: a share link to an AI chat is publishing, and needs the same approval as emailing that content outside the company. It fits under "Data rules" in our shadow AI policy template.
- Test the next tool yourself. Before approving an assistant, create a share and look at the address. If the title shows up in the hostname, count it as a failed check when you vet the tool.
What we could not confirm
Meta hasn't said whether existing share pages were deleted or only disabled, whether affected users were told, or when sharing returns. We couldn't load Meta's help page on share links, which Claroc says describes Meta AI links that don't expire, so we haven't relied on it. We also can't tell how many of the exposed pages held personal data; Claroc's sample was a few hundred.
