Meta has switched off the ability to share conversations from Muse, its new personal AI agent, after a security firm showed that shared chats could be found by people who were never sent the link. Meta confirmed the pause to Ars Technica and The Verge on Tuesday, October 20, 2026, saying it is reviewing the report and considering changes to how the links can be discovered.
The research comes from Claroc, which calls the problem GhostShares. When a Muse user asks to share a conversation, the agent publishes it as a web page that opens for anyone holding the link, with no login. That is common for AI assistants. The difference, according to Claroc, is that Muse built each address as a subdomain that begins with the conversation's title, followed by a random identifier, under a content domain run by Meta.
That design leaks through the internet's naming system. When a recipient opens a link, their browser looks up the hostname, and commercial passive DNS services record those lookups and make them searchable. Claroc says a single query against such a dataset returned more than 6,800 Muse share hostnames about a month after the product's September 8 launch. Because the titles were readable, the list itself revealed what many pages contained, and the random part of the address offered no protection once it had been logged.
The firm says it opened only a few hundred pages, most of them harmless. A minority were plainly sensitive: a small-business loan application with the amount requested, a revenue review marked for a company's chief executive, a full-year staff holiday calendar, a to-do list that referred to a fraud warning from a bank and showed part of an account number, and notes for a job candidate's confidential call with a frontier AI lab. Claroc adds that the public scanning service urlscan.io already stored over 75 captures of these pages. Blocking search-engine crawlers, which Muse did, does not stop this kind of discovery.
Claroc co-founder and chief technology officer Asaf Aprozper told Ars that he reported the issue through Meta's bug bounty program on October 8 and heard nothing back. In its statement, Meta said the bounty program exists so researchers can raise scenarios like this one, and that shared artifacts are reachable by anyone with the link. On October 20, Claroc rechecked 40 shares that had previously opened without an account and found that none loaded. It notes, however, that the hostnames and their titles remain in passive DNS history.
The episode matters because Muse is designed to act for users, filling in forms, booking appointments and making purchases, which requires access to many of their accounts. Ars recalls that a separate flaw found weeks after launch allowed other apps on a device to take over a Muse account. Earlier, shared ChatGPT and Grok conversations also surfaced in search results, and the Muse case shows that keeping share pages out of search engines is not enough.
Claroc did not contact the affected people and says it has no evidence of misuse. Meta has not said how many users were exposed, whether it will notify them or when sharing will return.