Security researchers at Claroc have shown that shareable links created by Meta’s Muse AI agent were discoverable through ordinary passive DNS records, allowing people who never received the links to open the pages. A single query against the domain used for Muse shares returned more than 6,800 hostnames. When the researchers opened a few hundred of those pages, they found conversations that included personal financial details, internal business documents, and other material the users had not intended to make broadly available.
Muse, Meta’s general-purpose AI agent launched in September 2026, lets users share specific conversations or artifacts by generating a web page that anyone with the link can open, usually without signing in. That behavior is intentional. The problem Claroc identified is in how the addresses were built. Each share hostname incorporated the conversation’s title followed by a random identifier, under the domain cf.metaaiusercontent.com. When a browser resolved one of those names, the full hostname could be recorded by passive DNS systems that log lookups. Because the titles were readable, a search of those records functioned like a table of contents for the shared pages.
Claroc’s team reported the issue to Meta’s bug bounty program on October 8. They later described the findable pages as GhostShares—conversations users had shared via links that could also be located independently. Among the pages the researchers reviewed were notes a candidate prepared for a confidential executive-search call with a frontier AI lab (including the lab’s internal contact and the meeting time), an internal revenue review marked for the CEO of a marketing company, a small-business loan application, a to-do list containing a bank-fraud alert with a partial account number, a real-estate investor’s performance figures, and a workplace vacation calendar listing dozens of employees. Most of the pages they checked were ordinary, but a minority contained clearly sensitive personal or organizational information. Claroc said it found no evidence the shares had been misused.
Meta told Ars Technica that users can share specific Muse artifacts, which creates a page accessible to anyone with the link. The company said it has paused the sharing functionality while it reviews the report and considers changes to how the links can be discovered. Claroc later confirmed that a sample of previously accessible shares no longer opened.
The episode is the latest security issue reported around Muse in its first weeks of public availability. Earlier, researcher Patrick Wardle disclosed a local zero-day in the macOS app that could allow malware already running under a user’s account to redirect transcription and capture authentication material; Meta issued a hotfix. Internal reports also indicated Meta engineers had rushed to address virtualization-related vulnerabilities shortly before launch. The DNS-related exposure is different in character: it does not require compromising a user’s device or account. It depends on the design of the share URLs and the public nature of DNS resolution records.
For organizations and individuals using AI agents that can act on connected accounts, fill forms, or handle calendars and financial information, the Claroc findings illustrate a practical risk. A feature intended only for deliberate sharing can become discoverable if the resulting addresses embed meaningful text and are resolved in public DNS. Meta has suspended the feature while it evaluates changes. Users who previously created Muse share links may want to assume those pages were potentially findable and review whether any sensitive material was included.