Sharing a Meta Muse conversation may create a link that others can find without receiving it from the person who shared it. Researchers from security firm Claroc said they identified 6,800 such links with one query, then opened a few hundred and found personal and business information.
The issue, as described by the researchers, lies in how the links are named and recorded. It raises a practical question for users: what should be treated as public when asking an AI assistant to share a conversation?
Share links were discoverable through DNS records
Muse lets users share searches, conversations, images, and similar material through a web link. Services commonly make these links difficult to guess by using a long sequence of text. But a hard-to-guess link may still be discoverable through other means.
Claroc said Muse share links use the domain cf.metaaiusercontent.com. The web address also includes the conversation name alongside a longer string. That combination gave researchers a way to look for links through passive DNS services.
Passive DNS databases preserve records of domain-name activity observed by monitoring systems. When someone clicks a share link, the DNS information can be recorded and later searched. The researchers said the titles embedded in Muse’s addresses made it easier to identify likely conversation links.
Opened links exposed sensitive details
After enumerating 6,800 links, the Claroc researchers examined a few hundred. They reported finding material that appeared to be intended for limited audiences, including notes for a confidential executive-search call, an internal revenue review marked for a CEO, and a small-business owner’s loan application.
Other examples included a to-do list mentioning a bank fraud alert and partial account information, a real-estate performance report with property and financial figures, and a workplace vacation calendar listing employees and their time away.
The examples span personal, financial, and workplace contexts. A conversation may seem useful to share in full, but it can contain details about other people or an organization as well as the information the user meant to send.
A public link can travel beyond its recipient
Claroc called these pages “GhostShares,” describing pages that open for people who were never given the link and can find it independently. The researchers said public-link sharing is common among AI assistants; in their account, Muse’s conversation titles inside the web address are what make its links easier to locate through public DNS records.
That distinction matters because sharing a link and publishing a conversation are not necessarily understood by users as the same action. Yet, according to Claroc, a link’s intended recipient is not the only person who may be able to reach it. Users should therefore consider the contents of a conversation before sharing it.
The concern sits alongside Muse’s broad access
Muse is presented as a general-purpose AI assistant that can fill out forms, book appointments, make purchases, create documents, and perform other actions. The source article says the assistant needs access to most of a user’s accounts to work as intended, while Meta has marketed it as deserving the trust that level of access requires.
The article also recounts a separate security concern: three weeks after Muse launched, macOS security expert Patrick Wardle discovered a zero-day vulnerability that could let another app on the same device take control of a user’s Muse account. Meta described exploitation as requiring a device that was already compromised. Wardle said a ClickFix attack could be enough to hijack an account.
These are distinct issues, but both relate to the amount of trust and access involved in using the assistant. The link findings show that privacy can also depend on design choices around sharing, including details that appear in a URL and may be retained in searchable records.
What users can do when sharing
Claroc co-founder and CTO Asaf Aprozper said the company contacted Meta and did not receive a reply. He wrote that the behavior appeared to be by design, and said users should know that asking Muse to share a chat creates a public link discoverable through the passive-DNS methods the researchers described.
For users, the source article recommends caution: limit personal information discussed in Muse conversations and delete share links as soon as possible. Before creating a link, it is sensible to review the whole conversation for confidential details, including information about colleagues, customers, finances, or accounts.
Deleting a link quickly may reduce the time it remains available, but the reporting describes DNS records as historical records. The central lesson is to treat a Muse share link as potentially discoverable and to avoid placing sensitive information in a conversation that may later be shared.