Shared conversations with Meta's AI could be found by strangers

When you share a conversation from Meta's AI service Muse, others may be able to find it even if they were never given the link. That's according to a new report from security firm Claroc.

Claroc has identified more than 6,800 addresses for shared Muse conversations under the domain cf.metaaiusercontent.com. The finding was made by searching commercial so-called passive DNS services. These are databases that collect which internet addresses are looked up. The links were therefore not handed over to Claroc. The information about the method comes from Claroc itself and has not been independently verified.

The title is in the address

Muse builds the address of a shared conversation from the conversation's title plus a random ID. When someone opens a shared link, the browser looks up the address, and the passive DNS databases can record and index both the title and the ID.

Claroc calls the exposed pages "GhostShares": pages that people can open and find on their own without having been given the link. According to Claroc, the random ID provides no real protection, because a hostname is not a secret. The report's introduction reads: "Unlisted is not private," meaning that a hidden address is not the same as a private one.

From harmless to sensitive

Claroc opened only a few hundred of the pages to check the content, without an account or login. Most were harmless, but a minority contained a lot of personal information and internal business documents. The exact share is not specified.

Claroc's examples include:

- a candidate's confidential preparation notes for a conversation with an executive from an AI lab - a revenue review addressed to the CEO of a nationwide marketing firm - a loan application from a small business owner with the amount applied for - a to-do list with a warning about bank fraud and a partial account number - a real estate investor's report with addresses and figures - a vacation schedule with dozens of employees

At least 75 of the pages had already been cataloged in the urlscan.io service, and 27 new hostnames were created on the last day of observation.

Timeline and recommendations

Muse was launched on September 8, 2026. Claroc investigated the matter in early October and reported the finding to Meta's bug bounty program on October 8, 2026. That is a program where security researchers can report flaws to the company. Claroc's report does not mention any public response from Meta.

The finding stands in contrast to Mark Zuckerberg's statement that Muse was "built from the ground up" with privacy and security in mind, news outlet Zetik reports.

Claroc recommends that companies' security teams map who uses Muse internally and inform employees about the sharing feature. They should also monitor public sharing and block muse.ai and metaaiusercontent.com if they have no insight into usage. According to Claroc, the same type of search should be repeated for other AI and web-based services.