Meta has paused a sharing feature in its Muse AI agent after security researchers demonstrated that conversation links intended for selected recipients could be discovered by outsiders. The issue stemmed not from guessing the long random portion of a link, but from the way Muse placed conversation titles in individual subdomains.
Researchers at security company Claroc said they enumerated about 6,800 sharing links and inspected several hundred. According to the report, some pages contained personal or business information that appeared unlikely to have been deliberately published for general access. Meta told Ars Technica that it had suspended the functionality while reviewing the findings and considering changes to how the links can be found.
Muse allowed a user to create a web address for searches, conversations, images and other material. Such links commonly rely on an unguessable token: anyone possessing the address can open the page, but people who were never given it should have little practical way to locate it. Muse used long identifiers, yet it also incorporated the conversation name into a subdomain under cf.metaaiusercontent.com.
That architecture exposed a different discovery path. When a recipient opened a shared page, DNS infrastructure observed a lookup for its hostname. Commercial passive-DNS services collect historical records from resolvers and other sensors, making previously queried hostnames searchable. Because the descriptive title appeared in the hostname rather than after the domain in a URL path, researchers could search those records for Muse shares. Claroc called the resulting discoverable pages “GhostShares.”
Claroc co-founder and chief technology officer Asaf Aprozper said he submitted the issue through Meta’s bug-bounty program on October 8. Meta said the program was open so researchers could report different scenarios and emphasized that users had chosen to create pages accessible to anyone with the relevant link. Its decision to pause the feature acknowledges that link accessibility and link discoverability are separate privacy questions.
The finding carries added weight because Muse is designed to perform tasks across user accounts, including forms, appointments, purchases and document creation. That functionality can require access to unusually sensitive information. A sharing mechanism therefore needs to communicate clearly whether it creates a narrowly distributed link or a page that can be found through third-party infrastructure.
Suspending sharing removes this specific exposure while Meta investigates, but it does not by itself explain how long links were discoverable or how many contained sensitive material. The episode is also a reminder for web services that randomized URLs are only one part of link privacy. Information placed in hostnames may leave traces in DNS systems even when the full URL path remains secret.
