Meta Muse AI Flaw Exposes Confidential Business Data via Shared Chat Links

Key Takeaways

• A privacy vulnerability in Meta Muse AI’s conversation sharing feature exposed confidential business and personal data.
• The flaw, dubbed “GhostShares,” allowed unauthorized access to shared chat content via passive DNS records, even without direct links.
• The issue stemmed from how Muse constructed shared page URLs, incorporating conversation titles and random identifiers into hostnames.
• Meta has temporarily disabled the conversation sharing feature to address the vulnerability.
• No evidence of misuse has been reported, but historical DNS records still retain some exposed hostname information.

Meta has temporarily suspended the conversation sharing functionality within its Muse AI platform following the discovery of a critical privacy flaw. This vulnerability, which could expose sensitive business documents and personal information, allowed unauthorized individuals to access confidential data through discoverable chat links.

The exposure specifically impacted conversations that users had explicitly chosen to share, not all private Muse interactions. Critically, anyone who located an affected link could view its contents without requiring authentication or a login.

The root cause of the data exposure lay in the architecture of Muse’s shared page addresses. Conversation titles and unique identifiers were embedded within hostnames, which were subsequently recorded by passive DNS services. These services log observed domain lookups, inadvertently creating a pathway for third parties to identify and access shared pages without ever receiving the original link from the owner.

Researchers from Claroc identified this vulnerability, labeling the exposed pages “GhostShares.” Their report details a fundamental weakness in the sharing design, emphasizing that the issue was not the result of malware or a confirmed cyberattack.

Claroc submitted their findings to Meta’s bug bounty program on October 8, 2026, after conducting checks on the affected pages on October 7 and 8.

Meta Muse AI Privacy Flaw Exposes Confidential Business Data

Muse hosted shared content under the domain cf.metaaiusercontent.com. Each shared conversation generated a hostname that combined a human-readable conversation title with a randomly generated ID.

While this random ID was intended to make direct guessing difficult, passive DNS systems could capture and store the complete hostname, including the supposedly private portion, whenever a lookup was observed.

This allowed researchers to reconstruct functional links from these historical DNS records. This method required no password cracking, account compromise, or security bypass techniques.

Unlike previous instances of shared conversation exposure, such as those involving ChatGPT and search engine indexing, this vulnerability leveraged DNS history. This distinction renders traditional crawler restrictions, like robots.txt files, ineffective against this discovery method. Claroc also noted over 75 saved scans of Muse share pages on urlscan.io, indicating another potential avenue for discovery.

After filtering out unrelated wildcard DNS scan noise, Claroc identified more than 6,800 unique share hostnames. The researchers accessed only a few hundred of these pages, so this figure does not confirm that all 6,800 represented sensitive conversations.

The majority of inspected pages contained ordinary content; however, a significant minority held highly sensitive records. Examples included a marketing firm’s revenue review intended for its CEO, a small business loan application, and a property investor’s financial report.

Additional exposed pages contained a bank fraud alert with partial account details and a staff vacation schedule. This incident mirrors earlier disclosures involving Grok’s shared chats, which similarly highlighted how public sharing features can inadvertently broaden access beyond the intended recipients.

One particularly concerning discovery was a page containing confidential preparatory notes for an executive search call with a leading AI laboratory, including an internal contact name and meeting time. Such detailed information could be exploited for impersonation schemes or targeted fraud attempts.

Claroc found no evidence of malicious exploitation and redacted all affected names, hostnames, titles, figures, and links from their report. The researchers observed that Muse initially returned minimal content beyond the share title, with the full conversation loading via JavaScript afterward. Consequently, a basic page fetch might not reveal the complete content that would appear in a standard browser. Researchers used typical browser sessions without logging in and ceased investigation if a page prompted for a password.

They did not directly contact the affected individuals or businesses, therefore they could not definitively confirm whether these users intended their documents to be so widely accessible online.

Meta Pauses Sharing as Risks Remain

On October 20, Meta said it had temporarily disabled the conversation sharing feature while it reviewed Claroc’s findings and explored modifications to prevent similar link discovery issues.

Claroc re-examined 40 previously accessible shares on the same day; none could be opened, and their content hostnames generated errors. However, it is crucial to note that historical DNS records still retain the previously exposed hostnames and conversation titles.

This distinction is vital: while Meta has blocked current access to these pages, the underlying information that led to their discovery remains archived in passive DNS systems. Reports concerning indexed Claude shared chats further underscore the broader risks associated with treating public links as secure, private collaboration tools.

Despite the findings, Claroc’s limited sample size prevents a comprehensive assessment of Muse’s total exposure, the duration each page remained accessible, or whether other parties had previously accessed the content.

Organizations are advised to review employee usage of Muse, ascertain if business-related conversations were shared, and educate staff that public links are not inherently restricted to designated recipients.

Claroc recommends monitoring share creation as a form of outbound data transfer. Where adequate controls are absent, they suggest blocking muse.ai and metaaiusercontent.com using managed proxy or DNS filters to prevent potential data leakage.

Indicators of Compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

What You Should Do

• Audit AI Tool Usage: Conduct an internal audit to identify if Meta Muse AI, or similar generative AI tools, are being used for sensitive business discussions.
• Review Sharing Practices: For any AI tools with sharing features, review and reinforce policies regarding what information can be shared externally. Emphasize that “shareable links” may not guarantee privacy.
• Educate Employees: Train staff on the risks associated with sharing AI-generated content, especially when it contains proprietary, confidential, or personally identifiable information (PII).
• Monitor Outbound Data: Implement or enhance monitoring of outbound data transfers, particularly for unusual activity involving AI-related domains or public-facing content sharing services.
• Implement Network Controls: Consider blocking access to muse.ai and metaaiusercontent.com at the network perimeter via managed proxy or DNS filters if business needs do not justify their use or if adequate controls cannot be enforced.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.