Meta has temporarily disabled the sharing‐conversations feature in its Muse AI tool after researchers discovered a significant privacy lapse that exposed sensitive business and personal information via shared chat links. The flaw, uncovered by Claroc, didn’t affect private conversations by default, but any shared links could be accessed by third parties simply by discovering them—no login required.
How the Exposure Worked
Muse generates shared links under hostnames like cf.metaaiusercontent.com. These hostnames combined a human-readable conversation title with a random identifier. While that random piece made blind guessing impractical, passive DNS systems—tools that log domain name lookups—saved full hostnames including the conversation title. Attackers or curious third parties then could reconstruct working links using those passive DNS records.
The issue was distinct from past incidents where shared AI conversations ended up indexed by search engines. Even with a robots.txt entry forbidding crawling of shared Muse paths, hostnames were still leaked via DNS. Claroc also found over 75 archived scans of Muse share pages on urlscan.io, demonstrating that discovery didn’t need to rely on search engines.
What Was at Risk
Among the inspected handles—hundreds accessed during testing—some links hid seriously sensitive information. Examples included a company’s revenue document intended for executive eyes only, a loan application, financial reports, partial bank account details from a fraud alert, staff vacation schedules, and confidential materials for recruiting high-level experts.
Claroc’s review sampled share pages without using accounts: several were fully exposed via browser fetches, though some content required JavaScript to load. Investigators didn’t contact exposed individuals, so couldn’t confirm whether content was meant to be public or private.
Meta’s Response and What Remains
On October 20, 2026, Meta acknowledged the issue and disabled the vulnerable sharing mechanism while reassessing how shared links could be discovered without proper authorization.
Although shared pages are no longer accessible via those hostnames, historical DNS records with titles and hostnames are still floating around—meaning the data could still be discoverable in theory.
Claroc urges organizations to audit how Muse is used internally, ensuring staff understand that sharing a link doesn’t guarantee privacy. They also recommend blocking domains linked to this leakage—such as muse.aiand metaaiusercontent.com—through DNS filters or managed proxy systems when possible.
Your mitigation strategy should include monitoring outbound data transfers tied to share-link creation and verifying that document control policies cover AI tools like Muse.
Without a doubt, this highlights a larger risk in AI collaboration tools: features marketed as convenient public sharing can unintentionally expose data if discovery mechanisms are not tightly controlled. Going forward, Muse and competitors will need better designs that don’t replay titles or IDs in public hostnames. What to watch for: whether Meta purges old DNS records, how it redesigns sharing URL structures, and whether regulatory scrutiny tightens around shared AI content.
