Meta Muse leak: 6,800 shared chats exposed through public DNS

On October 18, the company Claroc published its “GhostShares” report, describing a Meta Muse leak: conversations people had shared from Meta’s AI agent could be found through public DNS records. On October 20, Ars Technica covered the story, and Meta paused the sharing feature.

Details of the Meta Muse leak

Muse is the AI agent Meta launched on September 8. It can search the web, fill in forms, book meetings, and connect to a user’s accounts, including their calendar and email (that’s how Gadget Review describes it). You can share a conversation with a link, and that link’s design was exactly where the problem lay.

According to the Claroc report, the address of every shared conversation was built from its title and a random identifier, placed in a subdomain name under cf.metaaiusercontent.com. In the report’s words, “Muse names each share’s web address after the conversation’s own title, and that address is written into public DNS”.

Which means that:

1. When someone opened a shared link, their browser queried DNS for the full hostname.
2. Passive DNS services record such queries and make them searchable, so the hostname together with its “secret” identifier ended up in the history.
3. The hostname alone was enough to rebuild a working link, and the title itself often gave away the topic of the conversation before the page had even loaded.

There was no break-in and no password guessing: according to Claroc, a single passive DNS search returned thousands of these addresses, “like a table of contents”. As the researchers put it, an identifier only works as a secret as long as it stays secret, and “a hostname is not a secret”. A robots.txt file asked search engines to skip the shared pages, but that only governs indexing, not access itself (and the researchers didn’t need search engines at all).

What leaked?

After filtering out the noise, Claroc found more than 6,800 hostnames of shared conversations, and urlscan.io already held more than 75 saved scans of such pages. The researchers opened only a few hundred of them. Most were harmless, but among them were:

1. a candidate’s preparation for a confidential job interview at one of the leading AI labs, with the contact person’s name and the time of the meeting,
2. an internal revenue review of a marketing company, prepared for its CEO,
3. a small business’s loan application, with the requested amount,
4. a to-do list with a bank fraud alert, part of an account number, and transaction details,
5. a real estate investor’s report with addresses and loan amounts,
6. a full-year employee vacation calendar.

An important caveat: this concerns only conversations that users chose to share, not all private chats. Claroc also found no sign that anyone had misused the data, and it doesn’t publish any names or links.

How did Meta respond?

Claroc reported the issue through Meta’s bug bounty program on October 8. After Ars Technica’s article, Meta said that “we’ve paused this functionality while we review this report and consider changes to how these links can be discovered” (quoted by Dataconomy).

On October 20, the researchers rechecked 40 links that had worked before, and none of them opened anymore. The hostnames, and with them the conversation titles, still remain in passive DNS history, though.

Why is this getting so much attention?

Because Muse isn’t an ordinary chatbot but an agent with access to your calendar, email and documents, so conversations with it naturally contain business and financial data. The Hacker News thread about it collected more than 200 points, and the mechanism itself is remarkably simple: no exploit, just ordinary, publicly available tools.

It’s also not the first problem with shared chats. Cyber Security News recalls earlier cases of shared conversations from ChatGPT, Grok and Claude that ended up in public circulation. I also wrote recently about the OpenCode leak and the AI cyberattack on more than 100 companies: AI agent security is becoming one of the main topics this fall.

What to watch out for in the future?

First, a link for “anyone who has it” is in practice a public page. Let’s share only what we could show the world.

Second, conversation titles. With Muse, they were exactly what leaked, so let’s not put client names, amounts or people’s names in them.

Third, cleaning up after ourselves. Wherever possible, let’s delete shared pages once they’re no longer needed (let’s also check old links in ChatGPT and other tools).

Claroc advises companies to treat creating such links like sending data outside the organization and, where there’s no control over it, to block muse.ai and metaaiusercontent.com on company devices. It’s worth keeping in mind that Claroc sells tools for monitoring AI and SaaS usage, and the report ends with an ad for them.

FAQ

Did the Meta Muse leak affect all conversations?

No. According to the Claroc report, it concerns only conversations shared via a link. Private sessions weren’t affected by the problem described.

Do shared Muse links still work?

According to Claroc, the 40 links it rechecked stopped working on October 20, after Meta paused sharing. The conversation titles, however, are still visible in passive DNS history.

What is passive DNS?

These are databases that record observed DNS queries, that is, the domain names computers asked about, together with their IP addresses. They can be searched, so any hostname someone has visited may stay there for a long time.