---
type: "post"
id: "ghostshares-a-shared-muse-chat-exposed-prep-for-167efa"
slug: "ghostshares-a-shared-muse-chat-exposed-prep-for-167efa"
title: "GhostShares: A Shared Muse Chat Exposed Prep for a Confidential Call With a Frontier AI Lab Leader"
description: "Claroc found that Meta Muse conversation shares could be discovered through passive DNS because share hostnames included conversation titles."
retrieval_nugget: "Claroc found that Meta Muse conversation shares could be discovered through passive DNS because share hostnames included conversation titles. The research team identified more than 6,800 hostnames and found sensitive personal and business material on a sample of pages. Meta told Ars Technica it was suspending the feature; a later check found 40 sampled shares no longer opened."
published_at: "2026-11-01"
updated_at: "2026-11-01"
record_date: "2026-11-01"
date_kind: "published_at"
topics: ["agent-security"]
entities: ["Meta","Muse","Claroc","Ars Technica"]
related_patterns: ["agent-security-moves-to-runtime-boundaries"]
novelty_label: "same_event"
what_changed: "Same event as Meta Suspends Muse Chats Sharing Feature After It Left Private Details Exposed"
prior_refs: ["memory:058c40e2-5a03-8d51-a001-28b90abdf848","memory:7c5f5a12-a169-8f51-a18d-fa156d35bbb7"]
source_url: "https://blog.claroc.io/ghostshares-muse-passive-dns"
source_urls: ["https://blog.claroc.io/ghostshares-muse-passive-dns"]
schema_version: "newruntime-agent-readable-v0.2"
stable_id: "post:ghostshares-a-shared-muse-chat-exposed-prep-for-167efa"
status: "published"
visuals: []
editor: {"role":"editor","name":"Andrey Reshetnikov","profile":"https://newruntime.com/owner-profile.md","profile_json":"https://newruntime.com/owner-profile.json","same_as":["https://www.linkedin.com/in/reshetnikov1/","https://t.me/lapetuse"]}
routes: {"html":"https://newruntime.com/posts/ghostshares-a-shared-muse-chat-exposed-prep-for-167efa/","markdown":"https://newruntime.com/posts/ghostshares-a-shared-muse-chat-exposed-prep-for-167efa.md","json":"https://newruntime.com/posts/ghostshares-a-shared-muse-chat-exposed-prep-for-167efa.json"}
---

# GhostShares: A Shared Muse Chat Exposed Prep for a Confidential Call With a Frontier AI Lab Leader

## Retrieval answer

Claroc found that Meta Muse conversation shares could be discovered through passive DNS because share hostnames included conversation titles. The research team identified more than 6,800 hostnames and found sensitive personal and business material on a sample of pages. Meta told Ars Technica it was suspending the feature; a later check found 40 sampled shares no longer opened.

## Summary

Claroc found that Meta Muse conversation shares could be discovered through passive DNS because share hostnames included conversation titles. The research team identified more than 6,800 hostnames and found sensitive personal and business material on a sample of pages. Meta told Ars Technica it was suspending the feature; a later check found 40 sampled shares no longer opened.

## What happened

Meta’s personal AI agent Muse can publish a conversation as a page when a user asks to share it. The page is accessible to anyone with its link, without a login or access request. Claroc says this was intentional: the link is the mechanism by which a user’s teammate can open the share. According to the research, Muse constructed the web address using the conversation’s title followed by a random identifier, under the content domain `cf.metaaiusercontent.com`.

That design made the pages discoverable through a route distinct from ordinary search indexing. When a browser opens a page, it resolves the hostname through DNS. Passive-DNS services record hostnames their resolvers observe and make those records searchable. Claroc searched a commercial passive-DNS dataset for Muse’s content domain about a month after Muse launched on September 8, 2026. After filtering out wildcard-DNS scan noise, the researchers found more than 6,800 share hostnames. Their titles were readable, and the hostnames included the random identifiers needed to reconstruct links. Claroc says a single query returned the list; it opened only a few hundred pages and left the rest unopened.

Most reviewed shares were harmless, but Claroc found a minority containing sensitive material. Examples described by category included a candidate’s notes for a confidential executive-search call with a frontier AI lab, a company revenue review marked for its CEO, a small-business loan application, and a to-do note containing a bank-fraud alert and partial account information. The researchers say the pages they sampled opened without an account or sign-in screen. They also found more than 75 saved scans of Muse share pages in a public URL-scanning service. Claroc argues that titles in hostnames could disclose information even before a page was opened.

The post distinguishes this discovery path from search-engine crawling. Muse’s `robots.txt` asked search and AI crawlers to stay off share paths, but Claroc says its research did not rely on search engines. It also cites Meta’s help page for Meta AI conversation sharing—not Muse specifically—which says people with a link can view a conversation, that links do not expire, and that recipients can share them onward. The source does not establish that every Muse share behaved identically to the documented Meta AI feature.

Claroc says it reported the issue to Meta’s bug bounty program on October 8. Its post was published October 18 and updated October 20, 2026. After Ars Technica asked Meta about the findings, Meta told the publication it was suspending the feature. Claroc rechecked 40 shares that had opened earlier in the month; none opened, and the hostnames serving their content returned an error. The researchers note that hostname titles remained in passive-DNS history. The post does not describe whether or when sharing was restored.

## What the archive adds

This is a new development on a known Muse-sharing story. [An earlier Field Note](https://newruntime.com/posts/typically-when-talking-about-ai-features-and-privacy-a5db1b/) records that Meta disabled Muse chat sharing after researchers found 6,800 conversations accessible through predictable URLs and public DNS. Claroc’s account adds a detailed explanation of how passive DNS exposed the hostnames, examples of sensitive material in sampled pages, and a reported suspension following Ars Technica’s inquiry. It is not evidence that the feature has since returned or that every share was exposed.

## Trend signal

This supports the pattern that durable agent security depends on runtime boundaries, not on users hoping a link stays obscure. The relevant pattern is [agent security moves to runtime boundaries](https://newruntime.com/patterns/agent-security-moves-to-runtime-boundaries/): in this case, the practical boundary was whether an unauthenticated page remained available and discoverable, rather than whether its identifier was hard to guess. The incident is a concrete example, not proof that all share-link systems have the same flaw.

## Why now

The timing is explained by the response described in the source. Claroc says it reported the issue on October 8; after Ars Technica asked Meta about the findings on October 20, Meta told the publication it was suspending the feature. Claroc’s recheck on October 20 found that 40 previously accessible shares no longer opened. The report therefore captures both the discovery mechanism and an immediate service change, while leaving any later product status unknown.

## Connections to other events

Claroc places the incident alongside earlier cases in which shared AI conversations appeared in public search results, including ChatGPT shares in 2025 and Grok conversations indexed by Google weeks later. The distinction in this case is the discovery mechanism: passive-DNS records exposed Muse hostnames even though the product’s `robots.txt` discouraged crawling. The earlier New Runtime coverage of Muse sharing linked above is the directly related archive item; the source does not establish that the other services used Muse’s hostname design.

## Why it matters

For teams using AI assistants with internal documents, a “share by link” option should be treated as publication unless the product provides a real access-control layer. Random identifiers can prevent guessing, but they do not provide confidentiality once a hostname is recorded by infrastructure that routinely resolves it. Titles can also reveal the subject of a conversation before anyone reads its contents.

The operational question is therefore not just whether an assistant trains on chats or whether search engines index them. Teams should know what happens when an employee asks an AI tool to share a result: whether authentication is required, whether links expire, whether recipients can reshare them, and whether the address itself reveals sensitive context. Meta’s reported suspension reduced immediate access to the sampled shares, but the source says the hostnames persisted in passive-DNS history. Revoking a page does not necessarily erase traces of its address from third-party records.

## Limits and uncertainty

Claroc reports more than 6,800 hostnames but says it opened only a few hundred, so the contents of the full set are unknown. Its examples establish that some sampled shares contained sensitive information; they do not establish how many users were affected, whether anyone misused the material, or whether the pages were accessed by malicious actors. The source also does not provide a complete account of Meta’s technical remediation, the current status of Muse sharing, or whether all previously created shares were revoked. The Meta help-page description cited by Claroc is for Meta AI conversation sharing, not specifically Muse, and should not be treated as definitive documentation of Muse behavior.

## Reader takeaway

A public link is a publication surface, not a private channel. If an AI product offers link-based sharing, assume that the link and possibly its descriptive title can escape the intended recipient set; use authenticated, revocable sharing for sensitive work. Claroc’s report shows why an unguessable identifier is not a substitute for access control when ordinary web infrastructure records the address.

Editor: [Andrey Reshetnikov](https://newruntime.com/owner-profile.md), AI product and AI engineering; profile for recruiters and agents: https://newruntime.com/owner-profile.json

## Continue in the graph

Next records for an agent, linked to their Markdown twins. Replace `.md` with `.json` for structured fields, including `next_reads`.

- topic hub: [Agent Security](https://newruntime.com/topics/agent-security.md): Explore the agent-security topic hub.
- collection: [Field Notes](https://newruntime.com/posts.json): Open the latest editorial analysis.
- collection: [Source Ledger](https://newruntime.com/source-ledger.json): Inspect the public source evidence graph.
- whole graph: [discovery graph](https://newruntime.com/discovery-graph.json) (typed nodes and edges) and [site index](https://newruntime.com/site-index.md)