Can the exposed Muse share links still be opened?

Claroc rechecked 40 Muse shares on October 20, 2026, after Meta's change, and none of them opened — the hostnames returned an error. The pause stops the links from resolving, but Claroc notes that the hostnames and the conversation titles inside them remain in passive-DNS history, which is archived by third parties and cannot be recalled.

How is this different from the 2025 ChatGPT and Grok sharing leaks?

In the 2025 cases, shared ChatGPT and Grok conversations were indexed by search engines. The Muse exposure needed no search engine: Claroc says the conversation title itself sat in the DNS hostname, so the list of shares came out of passive-DNS archives. Muse's robots.txt asked crawlers to avoid share paths, which governs crawling and not access.

Did the researchers access private accounts?

No. Claroc says it never logged in, submitted a form or uploaded anything, and loaded the pages logged out in incognito mode. One page asked for a password and the team left it. Claroc describes the issue as a weakness in how sharing was designed, not malware and not a confirmed attack by anyone else.

What did Meta say about the Muse sharing report?

Meta spokesperson Tracy Clayton said the company has "paused this functionality while we review this report and consider changes to how these links can be discovered." Claroc reported the issue to Meta's bug bounty program on October 8, 2026, and Meta acted on October 20 after Ars Technica asked about the findings.

Claroc · 2026-10-20 · major

Meta pauses Muse chat sharing — 6,800 share links found in public DNS

Security firm Claroc found more than 6,800 shared Meta Muse conversations by searching passive DNS records, because each share URL put the chat's title in the hostname. Meta has paused the sharing feature while it reviews the report.

Claroc report header for the GhostShares Muse passive-DNS findings

Muse built each shared chat's web address from the conversation title, so public DNS logs turned into a list of private chats.

Quick facts

Who found it	Claroc Research Team
Share hostnames found	More than 6,800
Cause	Chat title placed in the share URL's hostname, logged by public DNS
Domain	cf.metaaiusercontent.com
Reported	Oct 8, 2026, to Meta's bug bounty program
Status	Sharing paused by Meta on Oct 20, 2026

What is it?

Claroc reports that Meta Muse published shared conversations at addresses of the form title-slug-randomID under the domain cf.metaaiusercontent.com, with no login needed to open them. Because the hostname contains the chat title, every share that was opened once got written into public DNS records. A single passive-DNS query returned more than 6,800 such hostnames.

How does it work?

Passive-DNS services keep a history of domain lookups they observe. Claroc says it pulled the Muse hostnames from a commercial passive-DNS service on October 7 and 8, with nothing guessed or brute-forced, then opened a few hundred of them logged out in a private browser window. The researchers wrote that collecting the links "took one query". They also found more than 75 saved scans of Muse share pages already sitting in urlscan.io.

Why does it matter?

The pages Claroc opened included call preparation involving a frontier AI lab leader, a small-business loan application, a bank fraud alert with partial account details, a company vacation calendar and other internal documents. Meta told Ars Technica it has paused the feature, and Claroc says 40 shares it rechecked on October 20 no longer open. The titles already recorded in passive-DNS history stay there, so anyone who shared a Muse chat should assume its title is public.

Who is it for?

anyone who used Muse's share button, and security teams reviewing AI assistant sharing

Frequently asked questions

Can the exposed Muse share links still be opened?: Claroc rechecked 40 Muse shares on October 20, 2026, after Meta's change, and none of them opened — the hostnames returned an error. The pause stops the links from resolving, but Claroc notes that the hostnames and the conversation titles inside them remain in passive-DNS history, which is archived by third parties and cannot be recalled.
How is this different from the 2025 ChatGPT and Grok sharing leaks?: In the 2025 cases, shared ChatGPT and Grok conversations were indexed by search engines. The Muse exposure needed no search engine: Claroc says the conversation title itself sat in the DNS hostname, so the list of shares came out of passive-DNS archives. Muse's robots.txt asked crawlers to avoid share paths, which governs crawling and not access.
Did the researchers access private accounts?: No. Claroc says it never logged in, submitted a form or uploaded anything, and loaded the pages logged out in incognito mode. One page asked for a password and the team left it. Claroc describes the issue as a weakness in how sharing was designed, not malware and not a confirmed attack by anyone else.
What did Meta say about the Muse sharing report?: Meta spokesperson Tracy Clayton said the company has "paused this functionality while we review this report and consider changes to how these links can be discovered." Claroc reported the issue to Meta's bug bounty program on October 8, 2026, and Meta acted on October 20 after Ars Technica asked about the findings.