Meta has temporarily suspended the conversation sharing feature in its Muse AI after researchers discovered that public links were providing access to sensitive personal data and internal corporate documents.
Meta has temporarily suspended the conversation sharing feature in its Muse AI after researchers discovered that public links were providing access to sensitive personal data and internal corporate documents.
On October 20, 2026, Meta blocked the chat sharing feature after requests from Ars Technica, which relied on an investigation by the Claroc research group, https://cyberpress.org/meta-disables-muse-sharing/ writes Cyber Press.
The problem was the design of the feature: when users asked Muse AI to create a link to a conversation, the assistant generated a public web page accessible to anyone with the web version of the URL. However, the researchers found that outsiders could find these links through passive DNS records, even if users did not send them to anyone.
The Claroc team discovered over 6,800 hostnames with links. The researchers only checked a few hundred of them, so this number reflects the number of addresses found, not the final volume of documents discovered or users affected.
Muse AI generated addresses for sharing in the form cf.metaaiusercontent.com, adding the name of the conversation topic and a random identifier to the host names. Passive DNS services recorded the history of requests to these addresses. As a result, text descriptions of conversations ended up in commercial databases. Although the identifiers themselves were difficult to select, they did not need to be selected - the full names of the addresses were already stored in search databases. Claroc called such accessible pages GhostShares.
In addition, the pages opened in a regular browser without authorization. And the operating instructions in the robots.txt file, which were supposed to prohibit indexing by search robots, did not prevent the detection of addresses through DNS records.
Most of the pages viewed contained mundane everyday queries. However, the researchers found several dozen confidential documents:
home purchase budget and small business loan application;
internal financial report addressed to the company's CEO;
bank fraud notification with partial account details;
employee vacation schedules and real estate investment reports;
details of preparation for a confidential call regarding the search for a top manager for the AI lab (with contacts and meeting time).
The exposed data could have been used for phishing, financial fraud, or impersonation. Claroc has not yet found evidence that anyone has used this information for malicious purposes.
Researchers reported the issue to Meta on October 8 through the bug bounty program.
After the official announcement of the suspension of the function on October 20, Claroc experts checked 40 previously accessible links - none of them were working anymore. However, historical DNS records still store hostnames with conversation headers, so closing access did not completely destroy traces of the leak.
