Meta Pauses Muse Share Links After Researchers Find 6,800 Discoverable Pages

Muse’s share links exposed a practical weakness in how the assistant handles private conversations: researchers at security firm Claroc found that a search of public DNS records could uncover links users had created to share content. They identified 6,800 links and, after opening a few hundred, found personal and business information that appeared intended for a limited audience. Meta has paused the sharing feature while it reviews the report and considers changes.

The issue wasn’t that the links lacked long, hard-to-guess strings. They had them. The problem was that Muse placed each conversation’s title in the link’s subdomain, where DNS records could make it searchable. A link might resemble q3-revenue-review-7b1e42f0.cf.metaaiusercontent.com: the random-looking characters add some obscurity, but the descriptive title gives a searcher a useful clue, and the shared domain helps locate the links in bulk.

What researchers found

Claroc reported finding material that included notes for a confidential executive-search call with a frontier AI lab, including an internal contact and meeting time; a company revenue review marked for its CEO; and a small-business owner’s loan application with the requested amount. Other examples included a bank fraud alert with part of an account number and a transaction’s amount and time, a property investor’s financial report, and a staff vacation calendar listing employees’ planned absences.

These examples span personal, financial, and workplace information. Their presence in share pages suggests users may have treated the links as restricted because they were difficult to guess. But a link that grants access to anyone who has it can become discoverable through other systems, even if a user never posts it publicly. Claroc described these pages as “GhostShares”: share pages that can be found by people who were never given the link.

“If you had asked us beforehand, we would have guessed that gathering these would take real effort,” the researchers wrote. “It took one query.”

Why DNS records mattered

Passive DNS services collect records of how domain names resolve over time. Their databases can be built from responses observed by monitoring systems at recursive DNS resolvers and other network infrastructure. When someone opens a share link, the associated domain can appear in those records. Commercial passive DNS services can then make observed domains searchable.

In Muse’s case, Claroc says all the links used cf.metaaiusercontent.com. That common domain offered a way to find the set, while the conversation title in the subdomain gave clues about the page’s contents. The long string attached to each title may have made individual links difficult to guess, but it didn’t prevent researchers from discovering them through DNS data.

This distinction matters for any service that shares content by link. A random token can help prevent someone from guessing a specific URL. It doesn’t guarantee that the URL stays secret if parts of it are exposed through records that third parties collect and index. Putting descriptive information in a subdomain can make that exposure more revealing and easier to search.

Meta’s response and the broader access question

Meta told Ars that Muse lets people share specific items by creating a page accessible to anyone with the link. The company said it had paused the feature while reviewing the report and considering changes to how the links can be discovered. Asaf Aprozper, Claroc’s cofounder and CTO, said he submitted the findings through Meta’s bug bounty program on October 8 and also tried to contact people at Meta on LinkedIn, without receiving a reply.

The incident puts added focus on Muse’s access model. The assistant can fill out forms, book appointments, make purchases, create documents, and perform other tasks. Those features require access to many user accounts, so the way Muse handles shared material is part of a larger question about how much trust the product’s design earns.

That question had already surfaced after macOS security researcher Patrick Wardle reported a vulnerability that could let another app on the same device take control of a user’s Muse account. Meta argued that exploiting it required a device to be compromised first. The source report says Wardle also found that a simple ClickFix attack could be enough to hijack an account. The share-link issue adds a separate concern: information may be exposed through the design of a sharing feature, without relying on that device vulnerability.

For now, Meta’s pause removes access through this particular sharing function while the company reviews it. The key design lesson is concrete: links intended for selected recipients can still become discoverable when their structure exposes descriptive details to searchable infrastructure. Any changes to Muse’s sharing system will need to address both link access and the information its web addresses reveal.

This story originally appeared on Ars Technica.