Meta has paused the conversation-sharing feature of its Muse AI assistant after security researchers discovered that roughly 6,800 shared chat links were effectively sitting in public, discoverable through ordinary internet infrastructure. The development, trending per news coverage, is one of the most significant AI-privacy incidents of the year — not because Meta was hacked, but because of a design decision that turned users' private conversations into open web pages whose addresses were listed, by name, in public records.

The company confirmed on Tuesday, October 20, that it had suspended the sharing functionality while it reviews the findings. The researchers who uncovered the flaw say the exposure required no hacking, no password guessing and no stolen accounts — just a single search of archived internet records.

What happened: 6,800 hostnames, one public list

The discovery came from Claroc, a cybersecurity research firm. Over the weekend of October 17–18, its researchers found that Muse, Meta's general-purpose AI assistant, generated sharing URLs in a predictable format: each conversation's title was written directly into the web address of its shared page, as a subdomain under cf.metaaiusercontent.com.

Examples the researchers cited looked like home-sale-budget-9f21c8a3.cf.metaaiusercontent.com and loan-application-draft-a4c9e2.cf.metaaiusercontent.com. Every time one of those pages was opened, the full address — including the descriptive title and the supposedly secret random identifier — was recorded in public DNS records, the global system that maps domain names to internet addresses. Passive-DNS services, which archive historical records of those lookups, preserved the complete hostnames.

"Muse names each share's web address after the conversation's own title, and that address is written into public DNS," Claroc said in its report. "One passive-DNS search brings back thousands of them, listed by name, like a table of contents."

Using a commercial passive-DNS database, Claroc identified more than 6,800 Muse share hostnames — the count of discoverable hostnames, not a count of confirmed victims — and examined a sample of several hundred. Anyone who found an affected link could open its full contents without signing in. Meta has disputed the framing: it says the flaw was in shared artifact URLs, not in chat sharing, and that press coverage describing a chat-sharing vulnerability was incorrect.

What was exposed

Most of the shared pages the researchers opened contained ordinary, non-sensitive material. But others contained exactly the kind of information users would never knowingly publish. Among the examples Claroc documented:

  • meeting details involving a leading AI lab;
  • a small-business loan application;
  • a bank fraud alert containing partial account information;
  • a company's internal revenue review and business documents;
  • an employee vacation calendar; and
  • confidential notes concerning a recruitment process.

Claroc dubbed the exposed pages "GhostShares" — shared conversations whose creators believed only the intended recipient could see them, but which were findable by strangers who had never been given the link. The researchers also found more than 75 saved scans of Muse share pages on urlscan.io, a public URL-scanning service, showing another route by which the pages could be discovered.

One important nuance: the flaw affected only pages users had chosen to share. Private, unshared Muse conversations were not swept up in the same way. But the sharing feature's own design made the "shared" status nearly equivalent to "public" — Muse's robots.txt file asked search and AI crawlers to avoid the share paths, yet that instruction did not restrict who could open a page and, crucially, did nothing to stop DNS records from being archived.

How Meta responded

Claroc reported its findings to Meta through the company's bug bounty programme on October 8, 2026, after verifying pages on October 7 and 8. Asaf Aprozper, Claroc's co-founder and CTO, submitted the report under the programme Meta set up to let researchers identify security issues in Muse.

Ars Technica first reported Claroc's findings. After questions from the publication, Meta confirmed on October 20 that it had suspended the conversation-sharing feature.

"We've paused this functionality while we review this report and consider changes to how these links can be discovered," a Meta spokesperson said in a statement. The spokesperson noted that the company launched the Muse bug bounty programme specifically so researchers could surface issues like this, and that shared Muse content generates a webpage accessible to anyone with the link.

Claroc subsequently tested a sample of the links it had previously accessed and found they could no longer be opened — Meta's update had cut off access. "We are glad to see it closed this quickly," the firm said in an update to its report, while adding that it had no evidence the exposed information had been misused.

Why DNS, not search engines, made this worse

The GhostShares episode differs in an instructive way from an earlier incident involving shared ChatGPT conversations turning up in search engines. In that case, the discovery route was search indexing, and crawler restrictions were at least part of the remedy. Here, the discovery route was DNS history — and crawler restrictions were beside the point.

Search engines can be told not to index a page. But DNS lookups happen before any page loads, and passive-DNS collectors simply record them. Once a share's hostname was observed, its full text — the conversation title and the random identifier meant to keep it secret — was preserved, and anyone with access to the archive could reconstruct working links. That makes the flaw a design problem rather than a malware or intrusion problem: the secret was never the link, it was the address, and the address was public by construction.

What users should do

Meta has not published a list of whose shares were affected, so the safest assumption for anyone who ever used Muse's sharing feature is that the shared page was potentially visible to strangers. Practical steps:

  • Review anything you shared from Muse and treat the contents as if they were published on the open web — because, in effect, they were.
  • Assume loan applications, bank alerts, internal documents and calendars that passed through a share link were exposed, and monitor for misuse.
  • Be cautious about sharing AI conversations at all until Meta explains how the replacement design works; a link that can be found without being given is not a private link.
  • For sensitive material, prefer copying text into a document you control over generating a shareable page.

The incident also arrives amid broader warnings about AI agents' security gaps and growing legal scrutiny of AI assistants — a reminder that the convenience of AI tools carries privacy costs that are still being mapped.

What happens next

Sharing is back on. On 22 October 2026, Meta said the underlying issue was fixed and restored the sharing feature, two days after pausing it on 20 October. Previously shared artifacts were assigned new URLs, and anyone opening an old link is now prompted to ask the sharer for the new one. The old hostnames, titles included, remain in passive-DNS history, where no fix can remove them.

For Meta, the timing is uncomfortable. The company has been pushing Muse as a flagship AI product, and trust is its most valuable feature. A bug-bounty report that sat for nearly two weeks before the feature was paused, and a flaw that turned "share with a friend" into "publish to the internet," will invite hard questions about how the design was reviewed in the first place. How Meta answers — and what the fixed sharing flow looks like — will determine whether users keep trusting the assistant with their documents.

Sources: Ars Technica; Claroc; Meta spokesperson statement; Benzinga; CyberSecurity News; dig.watch; Dataconomy; RocketNews.