Meta has paused the sharing feature of Muse, its personal AI agent platform launched last month, after security researchers showed that shared conversations could be found by anyone. Researchers at Claroc searched passive DNS records for Muse’s content domain and enumerated 6,800 shared conversation links.
The design flaw is specific. Muse names each share’s web address after the conversation’s own title, and that address is written into public DNS. “One passive-DNS search brings back thousands of them, listed by name, like a table of contents,” Claroc wrote, calling the exposed links GhostShares. The firm said it reported the issue through Meta’s bug bounty programme on October 8 and received no reply before publication.
In a sample of the links, Claroc found material plainly not meant to be public: a candidate’s confidential preparation for an executive search call with a frontier AI lab, including the lab’s internal contact and the meeting time, alongside a small business loan application, a bank fraud alert with partial account details, a company vacation calendar and other internal documents, as summarised by Engadget’s reporting of the same research.
Meta told Ars Technica it has “paused this functionality while we review this report and consider changes to how these links can be discovered.” Claroc said that when it rechecked 40 shares on October 20 that had previously opened without an account, none opened, although the hostnames, titles included, remain in passive DNS history. The exposure arrives while Muse is growing quickly: TechCrunch reported it reached 10 million US downloads in 40 days.