What happened
Meta’s personal AI agent Muse can publish a conversation as a page when a user asks to share it. The page is accessible to anyone with its link, without a login or access request. Claroc says this was intentional: the link is the mechanism by which a user’s teammate can open the share. According to the research, Muse constructed the web address using the conversation’s title followed by a random identifier, under the content domain cf.metaaiusercontent.com.
That design made the pages discoverable through a route distinct from ordinary search indexing. When a browser opens a page, it resolves the hostname through DNS. Passive-DNS services record hostnames their resolvers observe and make those records searchable. Claroc searched a commercial passive-DNS dataset for Muse’s content domain about a month after Muse launched on September 8, 2026. After filtering out wildcard-DNS scan noise, the researchers found more than 6,800 share hostnames. Their titles were readable, and the hostnames included the random identifiers needed to reconstruct links. Claroc says a single query returned the list; it opened only a few hundred pages and left the rest unopened.
Most reviewed shares were harmless, but Claroc found a minority containing sensitive material. Examples described by category included a candidate’s notes for a confidential executive-search call with a frontier AI lab, a company revenue review marked for its CEO, a small-business loan application, and a to-do note containing a bank-fraud alert and partial account information. The researchers say the pages they sampled opened without an account or sign-in screen. They also found more than 75 saved scans of Muse share pages in a public URL-scanning service. Claroc argues that titles in hostnames could disclose information even before a page was opened.
The post distinguishes this discovery path from search-engine crawling. Muse’s robots.txt asked search and AI crawlers to stay off share paths, but Claroc says its research did not rely on search engines. It also cites Meta’s help page for Meta AI conversation sharing—not Muse specifically—which says people with a link can view a conversation, that links do not expire, and that recipients can share them onward. The source does not establish that every Muse share behaved identically to the documented Meta AI feature.
Claroc says it reported the issue to Meta’s bug bounty program on October 8. Its post was published October 18 and updated October 20, 2026. After Ars Technica asked Meta about the findings, Meta told the publication it was suspending the feature. Claroc rechecked 40 shares that had opened earlier in the month; none opened, and the hostnames serving their content returned an error. The researchers note that hostname titles remained in passive-DNS history. The post does not describe whether or when sharing was restored.
What the archive adds
This is a new development on a known Muse-sharing story. An earlier Field Note records that Meta disabled Muse chat sharing after researchers found 6,800 conversations accessible through predictable URLs and public DNS. Claroc’s account adds a detailed explanation of how passive DNS exposed the hostnames, examples of sensitive material in sampled pages, and a reported suspension following Ars Technica’s inquiry. It is not evidence that the feature has since returned or that every share was exposed.
Trend signal
This supports the pattern that durable agent security depends on runtime boundaries, not on users hoping a link stays obscure. The relevant pattern is agent security moves to runtime boundaries: in this case, the practical boundary was whether an unauthenticated page remained available and discoverable, rather than whether its identifier was hard to guess. The incident is a concrete example, not proof that all share-link systems have the same flaw.
Why now
The timing is explained by the response described in the source. Claroc says it reported the issue on October 8; after Ars Technica asked Meta about the findings on October 20, Meta told the publication it was suspending the feature. Claroc’s recheck on October 20 found that 40 previously accessible shares no longer opened. The report therefore captures both the discovery mechanism and an immediate service change, while leaving any later product status unknown.
Connections to other events
Claroc places the incident alongside earlier cases in which shared AI conversations appeared in public search results, including ChatGPT shares in 2025 and Grok conversations indexed by Google weeks later. The distinction in this case is the discovery mechanism: passive-DNS records exposed Muse hostnames even though the product’s robots.txt discouraged crawling. The earlier New Runtime coverage of Muse sharing linked above is the directly related archive item; the source does not establish that the other services used Muse’s hostname design.
Why it matters
For teams using AI assistants with internal documents, a “share by link” option should be treated as publication unless the product provides a real access-control layer. Random identifiers can prevent guessing, but they do not provide confidentiality once a hostname is recorded by infrastructure that routinely resolves it. Titles can also reveal the subject of a conversation before anyone reads its contents.
The operational question is therefore not just whether an assistant trains on chats or whether search engines index them. Teams should know what happens when an employee asks an AI tool to share a result: whether authentication is required, whether links expire, whether recipients can reshare them, and whether the address itself reveals sensitive context. Meta’s reported suspension reduced immediate access to the sampled shares, but the source says the hostnames persisted in passive-DNS history. Revoking a page does not necessarily erase traces of its address from third-party records.
Limits and uncertainty
Claroc reports more than 6,800 hostnames but says it opened only a few hundred, so the contents of the full set are unknown. Its examples establish that some sampled shares contained sensitive information; they do not establish how many users were affected, whether anyone misused the material, or whether the pages were accessed by malicious actors. The source also does not provide a complete account of Meta’s technical remediation, the current status of Muse sharing, or whether all previously created shares were revoked. The Meta help-page description cited by Claroc is for Meta AI conversation sharing, not specifically Muse, and should not be treated as definitive documentation of Muse behavior.
Reader takeaway
A public link is a publication surface, not a private channel. If an AI product offers link-based sharing, assume that the link and possibly its descriptive title can escape the intended recipient set; use authenticated, revocable sharing for sensitive work. Claroc’s report shows why an unguessable identifier is not a substitute for access control when ordinary web infrastructure records the address.