News · 2026-10-21

Meta paused Muse sharing after researchers found conversation links through passive DNS

Meta said it paused Muse conversation sharing after Claroc reported that shared-chat hostnames could be discovered through passive domain-name records. Claroc found more than 6,800 share hostnames in one dataset and opened a sample without login or guessing identifiers. The report concerns conversations users had shared, rather than evidence that all private Muse chats were exposed.

Key facts

• Claroc reports more than 6,800 share hostnames in one passive-DNS dataset, not a count of all exposed users.
• The research appeared October 18; Meta’s pause was reported October 20, 2026.
• Claroc’s October 20 recheck found that 40 previously accessible sample links no longer opened.
• Primary source: Claroc’s GhostShares report; Ars Technica carries Meta’s response.

A long, random link often feels like an invitation sent to one person. Technically, it may instead be a public page whose address acts as the only secret. That distinction becomes consequential when part of the address reaches another system’s historical records. The person who receives the invitation is no longer the only person able to discover the page.

Claroc calls its investigation “GhostShares.” The firm says Muse share addresses combined a readable phrase based on the conversation’s title with a random identifier in the hostname. Opening a share requires resolving that hostname through the domain-name system, the infrastructure that translates website names into network destinations.

Some organizations collect historical records of those lookups, commonly called passive DNS. In this case, the full hostname could include both the readable title phrase and the random identifier. Once that name entered a searchable dataset, the identifier no longer functioned as an undisclosed secret. Claroc says it reconstructed links from those records and opened some without an account.

The analogy is a locked-looking envelope whose full contents can be collected by anyone who knows a pickup number. If the pickup number and a description of the contents appear in a searchable delivery ledger, the envelope’s obscurity offers little protection. Adding more randomness to the number does not help after the ledger records the complete number.

This mechanism differs from prompt injection: the exposure follows from sharing and naming design, rather than instructions that redirect the assistant. It also differs from ordinary search-engine indexing. Claroc reports that Muse’s crawler instructions asked search and AI crawlers to avoid the share paths. Those instructions do not prevent domain-name lookups or guarantee that historical lookup records remain private. They are also requests to crawlers, not access control that checks who may read the page.

The title itself is another exposure surface. Even if the content later stops opening, a descriptive hostname can reveal the subject of a conversation. In an AI assistant, people may use a chat as a working document: planning a business meeting, summarizing finances, preparing an application or arranging personal tasks. The metadata can carry meaningful context before anyone sees the full transcript.

Claroc describes a few sensitive examples involving business, financial and personal information. It says most of the pages it sampled were unremarkable, that it opened only a few hundred links, and that it found no evidence of misuse. Those limits matter. The dataset does not measure Muse’s total exposure, the number of affected people, or how long every page remained reachable.

The firm says it reported the issue through Meta’s bug-bounty program on October 8. Ars Technica’s October 20 coverage quotes Meta saying it paused sharing while reviewing the report and considering discoverability changes. Claroc’s update says none of 40 previously accessible sample links opened during its recheck. Their historical hostnames and title text remained in passive DNS.

That establishes a useful remediation observation, but not universal deletion. A 40-link sample cannot prove that every old address was invalidated. Nor can suspending a feature erase copies held in external historical datasets. The honest account distinguishes current access from lingering metadata and avoids claiming a complete cleanup that the evidence does not establish.

The strongest counterargument is that users had deliberately shared these conversations and that public-by-link access is a familiar product pattern. The report does not show an authentication bypass into unshared chats. The security concern is narrower and still real: discovery through lookup records can extend access beyond the recipients a user reasonably expected.

For AI products, the lesson is about sharing design rather than model behavior. Ground Truth’s information-flow lesson explains why controlling where information goes requires explicit rules. A share feature needs equally explicit decisions about authentication, expiry, discoverability and title metadata. Muse’s reported failure shows how infrastructure outside the chat interface can defeat the secrecy assumptions on which a convenient link depends.

Primary source, verified: read the paper →

Ground Truth. (2026, October 21). Meta paused Muse sharing after researchers found conversation links through passive DNS. Ground Truth. https://groundtruth.day/news/meta-muse-ghostshares-passive-dns-conversation-links.html

@misc{groundtruth:meta-muse-ghostshares-passive-dns-conversation-links,
  title  = {Meta paused Muse sharing after researchers found conversation links through passive DNS},
  author = {{Ground Truth}},
  year   = {2026},
  month  = {oct},
  url    = {https://groundtruth.day/news/meta-muse-ghostshares-passive-dns-conversation-links.html}
}

Topics: cybersecurity · ai-security · privacy · access-control · metadata