Researchers Found More Than 6,800 Muse Share Links in Public DNS Records. Anyone With the Link Can Read the Conversation.
On Oct. 18, 2026, security firm Claroc Research published “GhostShares,” a study of Meta’s personal AI agent Muse. Its finding: when a Muse user shares a conversation, the share page opens for anyone with the link, no login required, and the page’s address can be found in public DNS records.
Claroc says that, after filtering out noise, it found more than 6,800 Muse share hostnames and opened a few hundred. Most were harmless. Some were not: a loan application, a bank-fraud alert with partial account details, and a candidate’s prep for a confidential job interview.
Muse launched on Sept. 8 as a personal agent that can send email and book travel for its users. This is a separate problem from its launch-week privacy questions, and we found no Meta response to it.
- 6,800+share hostnamesfound in a commercial passive-DNS service about a month after launch, after filtering wildcard-DNS noise — Claroc
- 75+saved scansof Muse share pages already stored in the public scanning service urlscan.io — Claroc
- Oct. 8bug reportClaroc says it reported the issue to Meta's bug bounty that day; its Oct. 18 post reports no reply — Claroc
- 27new hostnamescreated on the last day Claroc checked, so the share feature was still generating them — Claroc
Claroc searched a commercial passive-DNS service roughly a month after Muse’s Sept. 8 launch. After removing wildcard-DNS noise it counted more than 6,800 hostnames of the form used for Muse share pages, . It opened only “a few hundred,” browsing logged out and in incognito mode, submitting nothing, and left one password-protected page alone.
Most pages it opened were benign, such as small-business sites and event calendars. Claroc says it has no evidence of misuse and cannot say how long any page was reachable. Its study covers one discovery channel on one product.
A Muse share page is built from the conversation’s title plus a random ID. Because DNS records the full hostname whenever someone loads it, any service that logs DNS lookups can end up storing the title and ID. Claroc says the pages need no login, and Meta’s own help page, which Claroc cites, says anyone with the link can see the conversation, the link does not expire, and it can be reshared. That help page covers Meta AI generally, not Muse specifically.
Muse’s robots.txt asks search crawlers to avoid share paths, but Claroc notes that governs crawling, not access: a person or tool holding the link can still open it.
Claroc describes the examples by category rather than publishing them. They include a candidate’s preparation for a confidential executive-search call with a frontier AI lab, a marketing firm’s revenue review marked for its CEO, a small-business loan application, a to-do list with a bank fraud alert and partial account number, a real-estate investor’s report with property addresses and financial figures, and a full-year staff vacation calendar.
“An ID only works as a secret while it stays secret, and a hostname is not a secret.”
Claroc Research Team — GhostShares, Oct. 18, 2026
Muse is marketed as a personal agent people can trust with their email and calendar. Claroc’s finding is about the opposite end of that pipeline: a convenience feature, sharing a chat, publishes the conversation with no login in front of it.
Claroc’s post describes its Oct. 8 bug-bounty report but no reply from Meta, and we found no Meta statement, fix or rollback as of Oct. 20. Claroc sells a product that monitors public AI share links, per its own post, so it has a commercial interest in the finding.
It is Muse’s third public privacy question in under two months. Inc. columnist Jason Aten reported in late September that Muse synced his Messages though macOS Full Disk Access was off; Meta’s communications head Andy Stone said access is opt-in with two settings, while Meta’s David Singleton described three permission steps, per Decrypt and The Next Web. On Oct. 9, Atlanta News First, citing reports from Yahoo Finance and Inc., said Muse had shared a user’s home address with a stranger and that Meta said it was investigating.
Established, per Claroc: Muse share pages open without a login, their hostnames carry the conversation title, and thousands appear in passive-DNS data. Not established: how many of the 6,800 are sensitive (Claroc opened a few hundred), whether anyone abused the exposure, how long pages were reachable, or whether Meta will change the feature. We found no regulator action on this finding.
Claroc reports that Meta Muse’s shared conversations open for anyone with the link and that more than 6,800 of their hostnames appear in public DNS data, including samples with loan and bank details. Claroc reported the issue to Meta on Oct. 8; its post reports no reply, and we found no announced fix.
