News & Blog

Your "Private" AI Chat Had a Public Address: Inside the Meta Muse Share-Link Exposure

TL;DR

  • Meta's Muse put each shared chat's title in its web address, letting a security firm find more than 6,800 shared conversations with one DNS search. Meta has paused sharing; for businesses, an AI share link is a publication.
A private chat streams out of a phone and lands as one entry in a vast public directory.
A private chat streams out of a phone and lands as one entry in a vast public directory. Conceptual illustration made with Gemini (gemini-4-argon-high) via Antigravity; it does not show any real system or product.

A personal agent with a sharing problem

Meta launched Muse, its personal AI agent, in the U.S. on September 8, 2026. According to Meta, it can send emails, book travel, fill out forms, and negotiate on a person's behalf, running on a dedicated cloud computer Meta calls Muse Secure VM, and Meta says it "built Muse from the ground up to be a safe, secure, private, and widely available personal AI agent."

Like many chatbots, Muse lets users share a conversation by link, and anyone with the link can open it without logging in. That is by design: Meta says sharing "creates a page that can be accessed by those with the link." The catch, uncovered by the security firm Claroc, is that people who were never sent a link could find these pages too.

The flaw was in the address

Muse built each share's hostname, the part of a web address your computer must look up, from the conversation's title plus a random ID. Claroc's made-up example: loan-application-draft-a4c9e2.cf.metaaiusercontent.com. When someone opens a link, their device asks the Domain Name System (DNS), the internet's address book, where that hostname lives, and commercial passive-DNS services record those lookups. The random ID couldn't be guessed, but it didn't need to be. As Claroc puts it, "a hostname is not a secret." Ars Technica pinpointed the design choice: putting the title in the subdomain rather than the URL path. Information in the path is not part of the DNS lookup; information in the hostname is.

From "share" to searchable: how a link meant for one person became findable by strangers.
Figure 1. From "share" to searchable: how a link meant for one person became findable by strangers. Diagram code written by Claude (Claude Code), rendered with matplotlib; labels checked against the sources.

"It took one query"

About a month after launch, Claroc searched a passive-DNS service and found more than 6,800 share hostnames, with titles that read like a table of contents. "It took one query," the researchers wrote. Claroc also found more than 75 saved scans of Muse share pages on urlscan.io, a public URL-scanning service. The researchers opened only a few hundred pages, in a browser with no account. Most were harmless, but some were clearly sensitive, including a job candidate's prep notes for a confidential executive-search call with a frontier AI lab, a revenue review marked for a company's CEO, a small-business loan application, a to-do list with a bank fraud alert and partial account number, a real-estate investor's performance report, and a full-year staff vacation calendar.

These figures come from Claroc alone. The firm notes that 6,800 counts links, reflects one discovery method on one product over a short window, not confirmed sensitive chats, and that it cannot say how long pages were reachable or whether anyone else found them first.

Tapping "share" adds a private chat to a directory that strangers can browse.
Illustration: tapping "share" adds a private chat to a directory that strangers can browse. Conceptual illustration made with Gemini (gemini-4-argon-high) via Antigravity; it does not show any real system or product.

Blocking search engines wasn't enough

Shared ChatGPT, Claude, and Grok conversations have all turned up in Google Search before, so Muse's robots.txt file asks crawlers to skip share pages. But robots.txt only governs crawling, not who can open a page, and it has no effect on DNS. Claroc's discovery never touched a search engine.

Meta's response

Claroc reported the issue to Meta's bug bounty program on October 8; co-founder and CTO Asaf Aprozper told Ars Technica he also tried reaching Meta staff on LinkedIn without a reply. After Ars asked about the findings, Meta said it had "paused this functionality while we review this report and consider changes to how these links can be discovered." Spokesperson Tracy Clayton gave The Verge the same statement. When Claroc rechecked 40 previously open shares on October 20, none loaded, but the hostnames remain in passive-DNS history. Claroc says it has no evidence of misuse.

Timeline of the Muse share-link exposure.
Figure 2. Timeline of the Muse share-link exposure. Diagram code written by Claude (Claude Code), rendered with matplotlib; labels checked against the sources.

Why it matters for business and IS (analysis)

The points below are analysis and opinion, not reported fact.

  • A share link is a data transfer. Treat an AI "share" like emailing a file to the open internet, and cover it in acceptable-use policies.
  • Shadow AI is the real exposure. Muse needs no IT rollout, so employees can use it with company data nobody approved. Claroc, which sells tools for this problem, advises finding out who uses it and blocking it if you can't monitor it; the advice holds even discounting the vendor's interest.
  • One design decision can undo a privacy promise. Putting the title in the hostname instead of the URL path turned private-by-obscurity links into a searchable list. Security reviews must examine how a feature is built, not just its settings.
  • This keeps happening. Leaks across ChatGPT, Claude, Grok, and now Muse point to a structural risk in AI sharing, and agents that act across email, files, and accounts raise the stakes.
  • Test it yourself: create a share in the tools your staff use and check what ends up in the hostname and URL.

Sources

← Back to News & Blog