Researchers Expose Meta Muse AI Conversations via DNS Records in GhostShares Flaw

A privacy flaw dubbed GhostShares allowed outsiders to discover shared Meta Muse AI conversations through passive DNS records, prompting the company to suspend the feature.

Threat Times Exposure DeskOctober 21, 20262 min read

Share LinkedIn Reddit

Illustration: A white smartphone rests on a wooden table beside a stylized network cable that loops toward a blank router. — AI-generated illustration: Threat Times

Key points

The GhostShares vulnerability allowed enumeration of shared Meta Muse AI conversation links via passive DNS records.
Meta suspended the Muse AI sharing feature on October 20 after being informed of the issue.
Researchers found over 6,800 share hostnames, revealing sensitive business and personal documents.

Meta suspended the public sharing feature of its Muse AI assistant on October 20 after researchers disclosed a privacy weakness dubbed GhostShares. This flaw allowed outsiders to discover shared conversations by querying passive DNS records, exposing personal files and internal business documents without requiring login credentials, according to GBHackers.

The vulnerability stemmed from how Muse constructed public sharing links, placing both descriptive titles and random identifiers directly into searchable hostnames under cf.metaaiusercontent.com. When browsers resolved these addresses, the complete hostnames were recorded by passive DNS providers. Researchers could then retrieve these historical records to reconstruct valid share links, bypassing the need for brute-forcing or guessing identifiers.

Technical Context and Discovery

Claroc, the researcher who identified the issue, reported finding more than 6,800 share hostnames after filtering out noise from wildcard DNS scans. This figure represents discovered hostnames rather than confirmed sensitive disclosures or the total volume of exposed conversations. Ars Technica independently verified the enumeration finding. The design meant that the random component offered little protection once the hostname was recorded in a public dataset.

Conversation titles embedded in the hostnames allowed researchers to identify potentially sensitive material before opening individual pages. This metadata effectively previewed the content, making it easier to target specific documents. The issue concerned discoverability rather than unauthorized access to private accounts, as Muse intentionally published conversations when users requested sharing.

Impact and Exposed Data

Researchers inspected only a few hundred pages, finding that sampled pages opened in ordinary browsers and even logged-out incognito sessions. Sensitive examples included a home sale budget, a bank fraud reminder containing a partial account number, and a small business loan application. Other pages revealed a CEO-restricted revenue review, property investment figures, employee vacation schedules, and confidential executive search preparation with a frontier AI laboratory.

This incident relates to earlier reporting by Threat Times on 2026-10-21, which noted Meta paused Muse AI sharing after a privacy flaw exposed business data via passive DNS records. The current GhostShares finding highlights similar challenges in managing metadata exposure in AI-generated sharing links. Meta told Ars Technica on October 20 that it was suspending the feature to address the issue.

What should you do?

Organizations using Meta Muse AI should review shared conversation links and ensure sensitive data is not exposed via public sharing features. Security teams should monitor passive DNS records for unexpected hostnames related to their domain. Users should avoid sharing confidential information through AI assistants until vendors confirm robust privacy controls are in place.

What to do and how to stay safe: Meta

Audit any publicly shared links from AI assistants to ensure they do not contain sensitive metadata or identifiers.
Monitor passive DNS records for unusual hostnames that could indicate exposed sharing links or metadata leakage.
Restrict the use of AI assistant sharing features for confidential business documents until vendors provide updated privacy controls.
Educate employees on the risks of sharing sensitive information through AI platforms and the importance of verifying link privacy settings.

Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the GhostShares vulnerability?

GhostShares is a privacy flaw in Meta’s Muse AI assistant that allowed outsiders to discover shared conversations through passive DNS records, exposing personal and business documents.

How many conversations were exposed?

Researchers found more than 6,800 share hostnames, but this represents discovered hostnames rather than confirmed sensitive disclosures or the total number of exposed conversations.