Meta Muse AI privacy vulnerability exposes 6,800 shared chats via DNS leak

Claroc did not breach any system to find over 6,800 exposed Meta Muse conversations - it ran a single passive-DNS search against the domain cf.metaaiusercontent.com and the results came back "listed by name, like a table of contents." ^[1]Muse's sharing feature builds each conversation's web address from the chat's own title plus a random identifier, and because that address lives in the hostname rather than the URL path, the title gets written straight into public DNS records the moment the link is created. ^[2]That is the crux of the design flaw: a hostname must be resolved through DNS before any encrypted HTTPS session even starts, so passive-DNS collection systems log it regardless of what happens afterward inside the encrypted request. A URL path, by contrast, never leaves the encrypted tunnel. As the finding put it: "It's this last design decision, putting the conversation title in the subdomain rather than in the URL path, that makes public discovery possible." ^[2]

The firm calls the exposed pages "GhostShares" - conversations that open for anyone who stumbles on them, never the people the sharer actually intended to reach. ^[3]No password, login, or Muse account was required to open an affected page once its hostname was known, which meant the random identifier Meta relied on for obscurity offered essentially no protection once it had already been logged. ^[4]This made the flaw unusually easy to exploit at scale: one query, thousands of private titles surfaced for free.

Claroc reported the issue through Meta's bug bounty program on October 8, 2026, after spot-checking sample share pages in the days leading up to the report. ^[1]It published its own GhostShares research publicly on October 18. Meta did not disable the sharing feature until October 20 - two days after that publication, and only after Ars Technica asked the company directly about the findings. ^[2]Meta's statement did not dispute any of it: "We've paused this functionality while we review this report and consider changes to how these links can be discovered." ^[2]Claroc's own reaction was notably generous given the twelve-day gap: "We are glad to see it closed this quickly." ^[5]The tension underneath that praise is real - the fix tracks press scrutiny more clearly than it tracks the original private disclosure.

Pausing new shares does not undo what already happened. The hostnames Muse generated - titles included - remain preserved in historical passive-DNS records indefinitely, so previously created shares can still be found by anyone willing to search that history, even though the feature itself is now switched off. ^[2]That matters because of what was actually exposed: an internal revenue review flagged for a CEO, a small-business loan application listing the requested amount, a bank-fraud alert showing a partial account number, a year-long employee vacation calendar, a real-estate investment report with property addresses, and confidential notes prepping a candidate for an executive-search call with a frontier AI lab. ^[1]Claroc has said it has no evidence any of this was misused, but it also cannot say how long the links were reachable before anyone noticed.

Muse is not the first AI assistant to leak shared conversations into public view. In August 2025, OpenAI's ChatGPT offered an opt-in "make this chat discoverable" toggle that let Google index roughly 4,500 shared conversations - some containing sensitive medical, personal, and business information - before OpenAI pulled the feature within days. ^[6]Separately, more than 370,000 shared Grok conversations turned up indexed by Google that same year, and a comparable pattern reportedly touched Claude's shared-conversation links in mid-2026. ^[6]What sets Muse apart is that no search-engine indexing was even necessary - passive DNS alone was sufficient, meaning the usual mitigation of blocking crawlers would never have helped, since DNS resolution happens before any crawler is ever involved.

Reaction across social platforms leaned heavily critical, framing the flaw in blunt terms - a security failure that leaves users open to identity theft - with no visible defensive voices pushing back on that characterization. On Reddit, the dominant tone was closer to resigned dark humor, treated as predictable given Meta's privacy history, though one notably contrarian comment pushed back on the Meta-specific framing, pointing out that other chatbot makers have had the same category of failure and arguing the real fix is restricting shares to authenticated accounts rather than relying on an obscure link. That split - systemic industry design flaw versus Meta-specific negligence - is likely to keep recurring as more companies bolt share buttons onto AI assistants without rethinking what a link actually exposes.

The DNS leak is a narrow bug, but it surfaced alongside broader internal criticism of Muse's security posture. Independent researcher Patrick Wardle argued that Muse's internal architecture, codenamed "Hatch," is inherently risky because it leans on a virtualization boundary to do the job of a production security boundary: "This issue is that Hatch makes the virtualization boundary a production security boundary... I feel like this design is inherently risky, particularly risky as AI lowers the cost of finding, analyzing, and exploiting exactly these kinds of complex virtualization vulnerabilities." ^[7]An unnamed Meta source went further, describing the security protections rushed out around Muse's launch as "half-baked protections being rushed out to enable the launch," and separate reporting cited unnamed senior Meta engineers who reportedly believe "it's inevitable we're going to have a massive data breach as a result of Hatch." ^[7]

Muse launched on September 8, 2026 - meaning the GhostShares exposure was discovered roughly a month after the assistant's debut. ^[1]Coverage of the security concerns was also tied to a reported 3.4% drop in Meta's stock. ^[8]Taken together with the DNS flaw, the picture that emerges is less a single engineering mistake than a pattern: a feature shipped on a compressed timeline, reviewed informally enough internally that senior staff voiced doubts before any public incident, and exposed externally through infrastructure that nobody on the product side appears to have threat-modeled for privacy at all.