Meta Pauses Muse AI Sharing After Privacy Flaw Exposes Business Data
Meta disabled Muse AI’s conversation sharing feature after researchers found that passive DNS records allowed anyone to view confidential business documents without logging in.
Key points
- Meta paused the Muse AI conversation sharing feature following reports of a privacy flaw.
- Researchers from Claroc used passive DNS records to reconstruct links to shared chats.
- Exposed content included financial reports, loan applications, and internal calendars.
Meta has paused the conversation sharing feature in its Muse AI companion app after a privacy flaw allowed unauthorized access to confidential business records and personal details. According to Cyber Security News, the issue stemmed from how the application constructed URLs for shared content, enabling anyone who discovered a link to view its contents without signing into an account.
The vulnerability affected only pages that users explicitly chose to share, rather than every private conversation within the application. However, the exposure mechanism meant that these shared pages were discoverable through public infrastructure records. Cyber Security News reported that the flaw allowed researchers to access sensitive data simply by finding the correct web address, bypassing standard authentication requirements entirely.
Technical Mechanics of the Exposure
Researchers from the security firm Claroc identified the issue, labeling the exposed pages as GhostShares. Their report describes a weakness in the sharing design rather than malware or a confirmed active attack by malicious actors. The team reported the vulnerability to Meta’s bug bounty program on October 8, 2026, after conducting initial checks on October 7 and 8.
Muse hosted shared content under the domain cf.metaaiusercontent.com. Each shared conversation’s hostname combined a readable title with a random identifier. Although the random ID made random guessing difficult, passive DNS services preserved the complete hostname when they observed domain lookups. This preservation included the supposedly secret portion of the address, allowing researchers to rebuild working links using historical DNS data.
Unlike previous exposure incidents involving other AI platforms that relied on search engine indexing, this discovery depended on DNS history. Cyber Security News noted that crawler restrictions, such as those in Muse’s robots.txt file, did not prevent DNS records from being stored or stop users from opening the pages. Claroc also found more than 75 saved scans of Muse share pages on urlscan.io, providing another route for discovery.
Scope and Affected Content
After filtering out unrelated wildcard DNS scan noise, Claroc counted more than 6,800 share hostnames. Researchers opened only a few hundred of these pages, meaning the total count does not represent confirmed sensitive conversations. Most inspected pages contained ordinary content, but a minority held sensitive records.
Examples of exposed data included a marketing company’s revenue review marked for its CEO, a small business loan application, and a property investor’s financial report. Other pages contained a bank fraud alert with partial account details and a staff vacation calendar. These findings highlight the risk of sharing sensitive information through links that can be reconstructed from public infrastructure logs.
What should you do?
Security professionals should monitor for any official updates from Meta regarding the resolution of this sharing flaw. Users who have shared sensitive information through Muse AI should assume that those specific links may have been accessible to unauthorized parties via DNS records. Organizations should review their data handling policies to ensure that confidential business records are not shared through third-party AI applications with known privacy weaknesses.
What to do and how to stay safe: Meta
- Avoid sharing sensitive or confidential business documents through third-party AI companion apps until vendors confirm robust access controls.
- Monitor official vendor communications for patches or feature updates that address URL construction and sharing privacy flaws.
- Review internal data handling policies to restrict the use of consumer-grade AI tools for processing or sharing proprietary financial or personnel records.
- Educate staff on the risks of sharing links that may be discoverable through passive infrastructure records like DNS logs.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Did this flaw affect all private conversations in Muse AI?
No, the problem affected only pages that users explicitly chose to share, not every private conversation within the application.
How did researchers find the shared links?
Researchers used passive DNS records that preserved the complete hostnames of shared pages, allowing them to reconstruct working links without needing passwords.
Is there a confirmed patch for this issue?
Meta has paused the conversation sharing feature, but the source material does not confirm the release of a software patch or update.
