Shared Muse chats can be found through passive DNS, Claroc says, because the title is in the hostname

When you ask Meta’s Muse agent to share a conversation, it publishes the conversation as a page and gives you a link. Anyone with the link can open it without logging in. That part is by design, and plenty of assistants work the same way. What security firm Claroc reports in a write-up it calls GhostShares is that you do not need to be sent the link to find one.

How the pages get found

According to Claroc, Muse builds each share’s web address from the conversation’s title plus a random ID, as a hostname under Muse’s content domain. The random ID is long enough that nobody could guess it. But the first time anyone opens the link, their browser looks up that hostname, and commercial passive-DNS services, which record the lookups their resolvers see, keep it in a searchable index. Title, random ID and all.

Claroc says one search of such a service, about a month after Muse launched on 8 September, returned more than 6,800 share hostnames after it filtered out scan noise. “If you had asked us beforehand, we would have guessed that gathering these would take real effort,” the researchers wrote. “It took one query.” Claroc also says the public scanning service urlscan.io holds more than 75 saved scans of Muse share pages.

Muse’s robots.txt asks search crawlers to stay off share paths, Claroc notes. That does not help here, because no search engine is involved.

What the pages held

Claroc says it opened only a few hundred, and that most were harmless: small-business pages, listings, event calendars. A minority were not. Described by category only, as Claroc published them, they included notes for a confidential executive-search call with a frontier AI lab, a company revenue review marked for its CEO, a small-business loan application, a to-do list with a bank fraud alert and a partial account number, a property investor’s performance report, and a workplace’s staff vacation calendar. We are not repeating any title, name or address, and neither did Claroc or Ars.

Claroc says it reported the issue to Meta’s bug bounty program on 8 October and has no evidence anyone misused the shares.

What Meta has said

Ars Technica says a Meta representative “didn’t immediately have answers” to questions sent by email. Claroc’s CTO, Asaf Aprozper, told Ars the company never received a reply from Meta and had concluded “this behavior is by design.” We found no Meta statement on this in the reports we read.

What to do

General advice, not Meta instructions: assume a shared Muse chat is public and has a readable name, and do not share anything by link that you would not post. Meta’s Muse privacy page explains deleting messages, side chats and resetting Muse, but says nothing about share links. Claroc quotes a Meta help page saying a shared Meta AI link “doesn’t expire,” while noting that page covers Meta AI, not Muse. We found no Muse-specific instructions for listing or revoking shares.

For security teams, Claroc’s own suggestions (it sells a product in this area) are to find out who uses Muse, add share links to AI usage guidance, and, if nothing else can see it, block Muse’s domains on managed devices.

Why it matters

Ars notes that Muse needs access to most of a user’s accounts to work as intended. This finding needs no exploit, only a share someone chose to make and a DNS lookup. It follows earlier Muse questions we covered, such as Cequence’s report that Muse reached more than half the customers it studied without identifying as an AI agent.