Meta Muse AI Privacy Flaw Exposes Confidential Business Data Through Shared Chat Links

Meta has paused Muse AI’s conversation sharing feature after a privacy flaw exposed confidential business records and personal details through discoverable chat links.

The problem affected pages users chose to share, not every private Muse conversation. Anyone who found an affected link could open its contents without signing in.

The exposure came from how Muse built shared page addresses. Conversation titles and random identifiers appeared in hostnames recorded by passive DNS services, which store observed domain lookups. Those records offered a way to find shared pages without receiving a link from the owner.

Researchers from Claroc identified the issue, naming the exposed pages GhostShares. Their report describes a sharing design weakness, not malware or a confirmed attack.

They reported it to Meta’s bug bounty program on October 8, 2026, after checking pages on October 7 and 8.

Meta Muse AI Privacy Flaw Exposes Confidential Business Data

Muse placed shared content under cf.metaaiusercontent.com. Each share’s hostname combined a readable conversation title with a random ID.

Although that ID made guessing difficult, passive DNS could preserve the complete hostname, including the supposedly secret portion, when participating services observed a lookup.

Researchers could then use those records to rebuild working links. No password guessing, stolen account, or security bypass was needed.

Unlike earlier ChatGPT shared conversation exposure involving search engines, this discovery relied on DNS history rather than indexed search results, making crawler restrictions beside the point.

Muse’s robots.txt asked search and AI crawlers to avoid share paths. That did not restrict who could open a page or prevent DNS records from being stored. Claroc also found more than 75 saved scans of Muse share pages on urlscan.io, showing another discovery route.

After removing unrelated wildcard DNS scan noise, Claroc counted more than 6,800 share hostnames. Researchers opened only a few hundred pages, so that figure does not mean 6,800 sensitive conversations were confirmed.

Most inspected pages were ordinary content; a minority contained sensitive records. Examples included a marketing company’s revenue review marked for its CEO, a small business loan application, and a property investor’s financial report.

Other pages held a bank fraud alert with partial account details and a staff vacation calendar. Earlier Grok shared chat exposure similarly showed how public sharing can widen access beyond intended recipients.

One page contained confidential preparation for an executive search call with a frontier AI laboratory, including an internal contact and meeting time. Such details could support impersonation or targeted fraud.

Claroc found no evidence of misuse and withheld affected names, hostnames, titles, figures, and links. Claroc noted that Muse initially returned little beyond the share title, with JavaScript loading the conversation afterward.

A basic page fetch could therefore miss content that appeared in a normal browser. Researchers used ordinary browser sessions without accounts and stopped when one page requested a password.

They did not contact the affected people or businesses, so they could not confirm whether those users intended their documents to be widely accessible online.

Meta Pauses Sharing as Risks Remain

On October 20, Meta said it had paused the feature while reviewing the findings and considering changes to link discovery.

Claroc rechecked 40 previously accessible shares that day; none opened, and their content hostnames returned errors. Historical DNS records still retained hostnames and titles.

This distinction matters: blocking page access does not erase information already stored elsewhere. Reports of indexed Claude shared chats underline the broader risk of treating public links as private collaboration tools.

However, Claroc’s limited sample cannot establish Muse’s total exposure, how long each page remained available, or whether others accessed it.

Organizations should review employee use of Muse, check whether business conversations were shared, and explain that public links are not restricted to named recipients.

Claroc recommends monitoring share creation as an outbound data transfer and, where adequate controls are unavailable, blocking muse.ai and metaaiusercontent.com through managed proxy or DNS filters.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.

The post Meta Muse AI Privacy Flaw Exposes Confidential Business Data Through Shared Chat Links appeared first on Cyber Security News.