New · October 21, 2026
Meta paused Muse chat sharing — after 6,800 "GhostShares" turned up in public DNS
A Muse share link puts the conversation's title inside the web address. Public DNS records kept every title searchable. One query returned 6,800 of them. Meta has now paused sharing while it "considers changes" — but the titles are still in the records.
How it happened, in order
🔍 Oct 18 — the finding
Security firm Claroc published "GhostShares": a single passive-DNS search for Muse's share domain (cf.metaaiusercontent.com) returned 6,800+ hostnames, each readable by conversation title. Almost every live share opened without a login. Claroc reported the issue to Meta's bug bounty on Oct 8 and got no reply — not even via LinkedIn.
⏸️ Oct 20 — the pause
After Ars Technica asked Meta about the findings, spokesperson Tracy Clayton told Ars and The Verge: "We've paused this functionality while we review this report and consider changes to how these links can be discovered." Claroc rechecked 40 shares the same day — none opened. But the titles remain in passive-DNS history.
⚠️ The pattern
This is not the first time: in 2025 shared ChatGPT conversations surfaced in Google results (OpenAI removed the option), and Google later indexed more than 370,000 Grok conversations. "Share by public link" plus "title in the URL" is a known-bad combination — and Meta shipped it anyway, weeks after Zuckerberg said Muse was "built from the ground up for privacy and security."
Why the titles leaked: "unlisted" ≠ private
- The random ID was fine; the title was the bug. Each share URL carries a long, unguessable random ID — but the first time anyone opens it, DNS logging records the entire hostname, title included, into passive-DNS datasets that anyone can search.
- robots.txt never protected you. Muse's robots.txt asks crawlers to stay off share paths, but Claroc notes robots.txt governs crawling, not access — and its discovery never touched a search engine.
- The pause is not a deletion. The feature is suspended; Meta has said nothing about whether old share links will return, whether existing pages were removed for good, or what a redesigned link system would look like.
- Scale is unknown. Claroc frames its finding honestly: one discovery channel, one hostname pattern, one product, a short window — not a measure of Muse's total exposure. 6,800 is a floor, not a ceiling.
If you ever shared a Muse chat
Claroc has no evidence anyone misused the shares — but assume worst case for anything sensitive:
- Delete share links you don't need. Meta's docs say deleting a link cuts off access for people who received it.
- Inventory what you shared. Conversations with finances, account numbers, addresses, client names, or internal business data should be treated as potentially exposed — rotate credentials and watch accounts.
- New rule going forward: only share conversations you'd be fine with strangers finding. If Meta restores sharing with random-only links, the title-in-DNS problem goes away — but we'll believe it when a researcher confirms it.
3 prompts to lock down your agent privacy
Muse is a powerful agent with broad access — the GhostShares story is a reminder to audit what it puts out, not just what you put in.
Audit what I've shared
List every conversation I've shared with a link in the last 60 days. For each: the conversation title, when the link was created, and whether the link is still active. Flag any whose title contains names, dollar amounts, account details, addresses, or employer names. Then delete the links for all of them.
Scrub before sharing
Before I share this conversation by link, review it for personal and business-sensitive content: names, emails, phone numbers, account numbers, addresses, internal business figures, and client information. Tell me exactly which lines I'd be exposing and suggest redactions — don't sanitize anything without showing me first.
Set my sharing rules
Write me a short personal policy for sharing AI conversations by link: which types of conversations are safe to share (with examples), which are never shareable, and a 3-step pre-share checklist. Keep it under 200 words so I can pin it next to my desk.
Good to know
- Meta's help documentation (written for Meta AI, described by Claroc as the closest published description of share links) says: people with the link can see your conversation, the link does not expire, the conversation is captured at the point the link is created — and you should be "mindful" when sharing conversations that discuss personal information or circumstances.
- This is a sharing feature story, not a prompt-injection or agent-hijack story. Your unshared Muse conversations are not implicated by this research.
- Privacy track record, same month: the Oct 17 scraping-terms reversal and the JPMorgan agent block (Oct 13) — trust in Muse is being priced in real time.
- New here? Set up Muse in 15 minutes → · Get 1B free tokens →
← Meta scraping terms · 10M downloads → · Muse on glasses · All news
Not affiliated with Meta. Figures: Claroc "GhostShares" research (Oct 18, updated Oct 20, 2026) at blog.claroc.io; Unite.AI; Ars Technica via reporting; Meta spokesperson statement via The Verge/Ars Technica. Claroc withheld all identifiers and has no evidence of misuse.