Meta Paused Muse Chat Sharing After 6,800 Share Hostnames Turned Up in DNS Records

Meta suspended chat sharing in its Muse AI agent on October 20 after the security firm Claroc showed that shared conversations could be found without the link, using public DNS history. Claroc counted more than 6,800 share hostnames in one passive DNS service.

Meta told Ars Technica it had "paused this functionality" while it reviews the report, according to MediaNama's account of the exchange. Muse launched in the US on September 8.

How the addresses leaked

Muse built each share address from the conversation's title followed by a random ID, on a subdomain of cf.metaaiusercontent.com, according to Claroc's research post, published October 18 and updated October 20. Passive DNS providers log the hostname whenever someone opens the page, so the title ends up in a searchable record.

The random ID was meant to make links unguessable. "An ID only works as a secret while it stays secret, and a hostname is not a secret," the Claroc team wrote.

What Claroc found, by the numbers

Claroc searched one commercial passive DNS service, which it did not name. After filtering out wildcard-DNS scan noise, more than 6,800 share hostnames remained. The team opened only a few hundred.

Item	Count or date
Muse launch (US, 18 and over)	September 8
Share hostnames recovered	more than 6,800
Pages opened by Claroc	a few hundred
Saved scans on a public URL-scanning service	more than 75
Reported to Meta's bug bounty	October 8
Claroc post published	October 18
Meta paused sharing	October 20

Pages loaded in an ordinary browser with no account. Claroc said it did not log in, submit forms or upload anything, and left one password-protected page alone. On its last check the share tier was still minting new hostnames, 27 of them that day.

Most pages were harmless, such as small-business sites and event calendars. The post described others by category only: preparation notes for an executive-search call with a frontier AI lab, a marketing company's internal revenue review marked for its chief executive, a small-business loan application, and a real-estate investor's performance report with property addresses.

Claroc said it has no evidence of misuse and did not contact affected users or companies.

What Meta has and has not said

Meta's only statement in either account is the pause. On October 20 Claroc rechecked 40 shares that had opened earlier. None loaded, and their hostnames returned errors.

Meta has not said whether existing links are permanently disabled, whether shared conversations were deleted from its servers, or whether it will stop putting titles in addresses before sharing returns, according to MediaNama, which said it had asked.

The hostnames and titles remain in passive DNS history. Claroc said copies "may still exist in third-party archives, cached pages, or saved scans" and added that it has not checked whether any are still public.

Meta's help page for sharing Meta AI conversations, which Claroc says is not specific to Muse, says people with the link can see the conversation and that the link "doesn't expire."

Where this sits among Muse's other problems

The pause adds to a run of Muse privacy disputes that MediaNama lists, including an October 6 TIME report on the agent's privacy practices and an Inc. columnist's claim that Muse read his private messages, which Meta disputed. For the model side of the Muse family, see our report on Meta's Muse Spark Open weights and licence. Another recent exposure, at a hosting platform, is covered in our report on Railway pausing deployments.

Claroc advised companies to treat AI share links as outbound data transfers, and to block muse.ai and metaaiusercontent.com at the proxy if they cannot detect Muse sharing. Meta has given no date for restoring chat sharing.