Meta Muse Share Links Exposed via DNS, Claroc Says

Conversations that people share from Meta’s Muse AI assistant can be found by strangers through public internet records, according to security firm Claroc, whose research was reported by Ars Technica on 20 October 2026. Claroc says a sample of the pages it opened included internal business documents and personal financial details.

The claim matters because Muse, which Ars notes needs access to most of a user’s accounts, is pitched on trust, and a shared chat carries whatever was discussed in it. Claroc, which sells security software to companies, says it has “no evidence that anyone has misused these shares”. Meta did not immediately answer Ars Technica’s questions.

In brief

Claroc says each Muse share link contains the conversation’s title and is logged in public DNS records, so links can be found without being sent them.
Its researchers say they found more than 6,800 share addresses and that a minority of the pages they opened held sensitive personal or business information.
The findings have not been independently verified, Meta has not responded, and Claroc says it has no evidence of misuse.

What does Claroc say it found?

In a blog post dated 18 October, Claroc’s research team says Muse share pages open “for anyone who has that link, without a login”, and that “that is by design”, since a public link is how the person a chat is sent to can open it.

The problem, Claroc argues, is how the links are built. “Muse names each share’s web address after the conversation’s own title, and that address is written into public DNS,” it wrote. DNS is the internet’s address book, and commercial “passive DNS” services keep searchable records of the web addresses their systems see being looked up.

Claroc says it searched one such service for addresses under cf.metaaiusercontent.com, the domain Muse serves shares from. “More than 6,800 share hostnames remained. We opened only a few hundred of them,” it wrote. “It took one query.”

Claroc’s figure	Detail
6,800+	Share addresses found via passive DNS
A few hundred	Pages opened by researchers
75+	Muse share scans held by urlscan.io
8 Oct 2026	Reported to Meta’s bug bounty

Source: Claroc blog post, 18 October 2026 (company research, not independently verified).

What was in the pages?

Claroc says most of what it opened was unremarkable, such as small-business sites and event calendars. It describes six sensitive examples by category only, naming no people or companies.

They include a candidate’s notes for a confidential executive-search call with a frontier AI lab, a company revenue review marked for its chief executive, a small-business loan application, and a to-do list with a bank fraud alert and a partial account number. The others were a property investor’s performance report and a workplace’s staff holiday calendar.

Each address also contains a random ID meant to be hard to guess. Claroc argues that this offers little protection once the full address is written into DNS. It adds that Muse’s robots.txt file asks search engines to stay away from share pages, but that this “governs crawling, not access”.

How have Meta and Claroc described the exchange?

Claroc says it reported the issue to Meta’s bug bounty programme on 8 October 2026. Its co-founder and chief technology officer, Asaf Aprozper, told Ars that Meta never replied, and that after checking similar platforms and Muse’s documentation, “we determined that this behavior is by design”.

A Meta representative “didn’t immediately have answers to questions sent by email”, Ars reported. Ars also noted that Mark Zuckerberg had said Muse was “built from the ground up for privacy and security”, and that macOS security researcher Patrick Wardle had earlier found a Muse account-takeover flaw.

What can users do?

The advice from Ars and Claroc is simple:

Treat shares as public. Aprozper told Ars that users should know that sharing a chat “creates a public link that can be discovered”. Claroc advises people to “assume anything you share is public until you have checked”.
Share less, and delete links. Ars advises Muse users to limit the personal information discussed in conversations and to delete share links as soon as possible.
For companies: set rules or block. Claroc suggests explaining in AI usage guidance what a share link does. If a company cannot see or govern Muse sharing, it suggests blocking muse.ai and metaaiusercontent.com on managed devices.

Our read

This is TSN’s analysis. Claroc’s point is less about a bug than a design choice: putting a readable title in a web address turns every share into a searchable label. A vendor selling monitoring tools has an interest in highlighting the risk, and its numbers are unverified. But the fix it implies, keeping titles out of share addresses, looks simple, and Meta has yet to say whether it will make it.