Meta suspended Muse's sharing feature and launched a bug bounty programme to help researchers identify security issues #
Meta's Muse AI assistant is facing privacy concerns after security researchers discovered more than 6,800 share links through passive-DNS records, some of which led to sensitive personal information and confidential business documents.
The findings have raised questions about the security of Meta's AI agent, which was promoted as a tool built around privacy and security. Meta has since suspended the conversation-sharing feature while reviewing the findings.
A Single Query Is All That's Required #
Ahead of Muse's September launch, Meta CEO Mark Zuckerberg said the assistant was 'built from the ground up for privacy and security,' according to Ars Technica. However, its URL design made shared links easier to discover.
Security firm Claroc reported that researchers identified more than 6,800 share hostnames through public passive DNS records. After opening a few hundred links, they found personal information and internal business documents, including material they assessed as sensitive or confidential.
'If you had asked us beforehand, we would have guessed that gathering these would take real effort,' the researchers wrote. 'It took one query.'
The exposed material included a small-business owner's loan application, a national marketing company's internal revenue review marked for its CEO, and a real estate investor's performance report containing property addresses and detailed financial figures. Researchers also found notes prepared for a confidential executive-search call with a frontier AI lab, including an internal contact and meeting time.
Another document contained a bank fraud alert alongside a partial account number and transaction details. A workplace's annual vacation calendar also listed dozens of employees and their planned time off. The findings were documented in Claroc's GhostShares investigation.
How Muse's Sharing Feature Exposed Private Information #
Researchers could identify Muse share links through passive-DNS databases, which retain records of observed DNS resolutions, including hostnames and associated IP addresses. According to Claroc, Muse hosted shared conversations on subdomains of cf.metaaiusercontent.com, incorporating conversation titles into the hostnames alongside random IDs. This made the links discoverable through searchable passive-DNS records, without researchers needing to guess URLs or obtain them from intended recipients.
Claroc argues that many AI assistants allow users to share conversations through public links. 'Plenty of AI assistants share by public link,' the cybersecurity firm said. 'What makes Muse's shares easy to find is the title sitting inside the web address, where public DNS records it for anyone to search. We call these GhostShares: pages that open for people who were never handed the link and that those people can find on their own.'
Meta Suspends the Feature Amid Privacy Concerns #
On 20 October, Meta confirmed that it had d the sharing functionality while reviewing Claroc's report and considering changes to how links could be discovered. 'We opened the Muse bug bounty program so researchers could raise different scenarios and help us continue improving the product,' company representatives told the New York Post.
The company added that sharing specific Muse content creates a page accessible to anyone with the link but said the functionality had been suspended during its review. The findings highlight the risks of sharing sensitive information with AI assistants and the importance of ensuring that convenience does not come at the expense of privacy.
© Copyright IBTimes 2026. All rights reserved.