{"slug": "one-search-turned-up-6800-shared-meta-muse-chats-including-a-loan-application-a", "title": "One search turned up 6,800 shared Meta Muse chats, including a loan application and a CEO’s revenue review", "summary": "Security firm Claroc reported on October 18 that a single query of public passive-DNS records surfaced more than 6,800 shared Meta Muse chat links, some containing a small-business loan application, a national marketing company's internal revenue review marked for its CEO, and a job candidate's notes for a confidential call with a frontier AI lab. Meta's Muse agent, launched September 8, publishes each shared conversation as a login-free page on its own subdomain under cf.metaaiusercontent.com built from the chat title plus a random ID; Claroc says it reported the issue to Meta's bug bounty program on October 8 and never heard back, and co-founder and CTO Asaf Aprozper told Ars Technica, \"we determined that this behavior is by design.\" Meta has not commented publicly on the report or said whether it will change how share links are built, and Claroc says it found no evidence of misuse but warns such a list is \"ready-made for fraud, impersonation or social engineering.", "body_md": "Meta CEO Mark Zuckerberg on stage at Meta Connect 2026 in September. Image: Meta\n\nMeta’s Muse AI agent turns a shared conversation into a public web page, and security firm Claroc says those pages are far easier to find than users would expect. In [a report published on October 18](https://blog.claroc.io/ghostshares-muse-passive-dns/), its researchers say a single search of public DNS records turned up more than 6,800 Muse share links, some holding loan paperwork, a company’s internal revenue review and a job candidate’s notes for a confidential call with a frontier AI lab.\n\nClaroc calls them GhostShares: pages that open for people who were never sent the link, and that those people can find on their own. Muse, which [Meta has sold on its privacy design](https://madrobot.blog/2026/09/25/what-is-meta-muse-ai-agent-explained/), launched on September 8.\n\n## How the links leak\n\nAsk Muse to share a conversation and it publishes the chat as a page anyone with the link can open, with no login. Plenty of AI assistants work the same way. The difference, Claroc says, is in how Muse builds the address.\n\nEach share gets its own subdomain under cf.metaaiusercontent.com, made from the conversation’s title followed by a random ID. Claroc’s simplified example: q3-revenue-review-7b1e42f0. The random part is long enough that nobody could guess it, but guessing is not needed: the first time anyone opens a share, their browser looks up the full hostname, and commercial passive-DNS services that watch those lookups record it and keep it searchable.\n\nA month after launch, Claroc searched one such service for Muse’s domain and, after filtering out noise, got back more than 6,800 share hostnames, listed by title. “If you had asked us beforehand, we would have guessed that gathering these would take real effort,” the researchers wrote. “It took one query.”\n\nMuse’s robots.txt file keeps search engines off share pages, avoiding the leak that put shared ChatGPT and Grok chats in Google results in 2025, but it does nothing to stop someone who already has the address. Claroc also found more than 75 saved scans of Muse shares on the public service urlscan.io.\n\n## What was in them\n\nThe researchers opened a few hundred pages, with no account. Most were harmless, but a minority were plainly sensitive. Claroc lists six by category, without names or links:\n\n- a candidate’s prep notes for a confidential executive-search call with a frontier AI lab, naming the lab’s internal contact and the meeting time\n- a national marketing company’s internal revenue review, marked for its CEO\n- a small-business owner’s loan application, with the amount requested\n- a to-do list including a bank fraud alert, with a partial account number\n- a real-estate investor’s performance report, with two property addresses and mortgage figures\n- a workplace’s full-year staff holiday calendar\n\nClaroc says it has no evidence anyone has misused the pages, but warns that a list like this is “ready-made for fraud, impersonation or social engineering”. Muse was still creating new share hostnames when it last checked: 27 in a single day.\n\n## ‘This behavior is by design’\n\nClaroc says it reported the issue to Meta’s bug bounty programme on October 8. Asaf Aprozper, its co-founder and chief technology officer, told [Ars Technica](https://arstechnica.com/security/2026/10/meta-muse-exposes-users-personal-and-business-secrets-when-they-share-conversations/) the company never heard back, and that it concluded Muse is working as Meta intended:\n\nAfter checking similar platforms, consulting with industry colleagues, and re-reading Meta Muse documentation, we determined that this behavior is by design. However, users should be aware that when requesting Muse to share a chat with someone, it creates a public link that can be discovered using the passive-DNS techniques we described.\n\nAsaf Aprozper, co-founder and CTO, Claroc\n\nMeta hasn’t commented publicly on the report or said whether it will change how share links are built. Its help page for Meta AI share links warns that the links don’t expire and can be passed on.\n\nIt is Muse’s latest privacy and security problem: a user said the agent [sold his keyboard and gave a stranger his home address](https://madrobot.blog/2026/09/28/meta-muse-ai-agent-shared-home-address-facebook-marketplace/), and Meta [rushed to fix flaws that could have let users break into its internal systems](https://madrobot.blog/2026/10/05/meta-muse-vm-escape-vulnerability-rushed-fix-before-launch/) before launch.\n\n## What Muse users can do\n\nFor now, the safest assumption is that any shared Muse chat is public: keep personal and work details out of conversations you plan to share, give them bland titles and delete share links once they have done their job. As Meta [pushes Muse into workplaces](https://madrobot.blog/2026/09/28/meta-enterprise-platform-muse-business-ai-cj-desai-mongodb/), Claroc advises companies to find out which staff use it and, if they can’t monitor it, block muse.ai and metaaiusercontent.com on managed devices.\n\n## Why it matters\n\nMuse asks for access to people’s accounts, documents and money on the promise that Meta can be trusted with them. A share feature that writes the subject of a private conversation into public records undercuts that promise, even if it is working exactly as built.\n\n*Sources: [Claroc, “GhostShares”](https://blog.claroc.io/ghostshares-muse-passive-dns/); [Ars Technica](https://arstechnica.com/security/2026/10/meta-muse-exposes-users-personal-and-business-secrets-when-they-share-conversations/) (Claroc comment).*", "url": "https://wpnews.pro/news/one-search-turned-up-6800-shared-meta-muse-chats-including-a-loan-application-a", "canonical_source": "https://madrobot.blog/2026/10/20/meta-muse-shared-chats-exposed-passive-dns-claroc-ghostshares/", "published_at": "2026-10-20 13:01:00+00:00", "updated_at": "2026-10-20 13:20:24.586333+00:00", "lang": "en", "topics": ["ai-safety", "ai-products", "artificial-intelligence"], "entities": ["Meta", "Muse", "Claroc", "Asaf Aprozper", "Ars Technica", "Mark Zuckerberg", "cf.metaaiusercontent.com", "urlscan.io"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/one-search-turned-up-6800-shared-meta-muse-chats-including-a-loan-application-a", "markdown": "https://wpnews.pro/news/one-search-turned-up-6800-shared-meta-muse-chats-including-a-loan-application-a.md", "text": "https://wpnews.pro/news/one-search-turned-up-6800-shared-meta-muse-chats-including-a-loan-application-a.txt", "jsonld": "https://wpnews.pro/news/one-search-turned-up-6800-shared-meta-muse-chats-including-a-loan-application-a.jsonld"}}