Meta has paused the Muse feature that shares conversations and artifacts by link, after a security firm reported that thousands of those links could be found through public DNS records. In an emailed statement to The Verge, Muse spokesperson Tracy Clayton said: "People have the ability to share specific Muse artifacts, which creates a page that can be accessed by those with the link. However, we've paused this functionality while we review this report and consider changes to how these links can be discovered." The Verge reported the pause on October 20, 2026, citing Ars Technica.
The researchers, at the security firm Claroc, say they found more than 6,800 Muse links. Those figures are Claroc's. Meta has not confirmed them, and we were unable to open the Claroc report itself, so everything below about the findings is as relayed by The Verge.
TL;DR
| Question | Answer |
|---|---|
| What happened? | Meta paused Muse conversation/artifact sharing |
| Why? | Claroc says share links were discoverable through public DNS records |
| How many links? | More than 6,800, per Claroc (not confirmed by Meta) |
| Why guessable? | Hostname built from the chat title plus a random ID |
| Meta position | Links are accessible only to those who have them; reviewing how they can be discovered |
| Is it a breach? | Not described as one; the pages were public to anyone holding the URL |
| What should users do? | Assume shared chats may be public; remove sensitive data; wait for Meta changes |
How did a private-looking link become findable?
A shared AI chat link is meant to work like an unlisted document: nobody sees it unless you send it. That model depends on the address being unguessable and not announced anywhere.
Claroc's finding, as quoted by The Verge, is that Muse broke the second condition: "Muse builds each share's web address from the share's title, a short phrase describing the conversation, then a random ID. The hostname usually gave away what a page held before we opened it, and since the link carries that same title and ID, a hostname pulled from DNS rebuilds the link."
In plain terms, the title of your chat became part of a hostname. Hostnames are not secret. Public DNS records, and tools that collect them, can list them. So a person did not need to guess the random ID: it was already in the hostname, and the whole link could be reconstructed from the record.
Envelope dripping data, illustrating the Meta Muse shared chats exposure
What was visible?
Per The Verge, Claroc says it could view hundreds of Muse conversations, including:
- a marketing company's revenue review,
- a small business owner's loan application,
- a workplace's full-year staff calendar,
- notes for a job candidate's call with an AI lab.
These are the kinds of things people paste into an assistant precisely because it is a personal agent. We have written about how much access Muse asks for: see the Muse dossier on contacts and Muse's launch security design.
Meta's position, and what it leaves open
Meta's statement stresses that a shared page "can be accessed by those with the link." That is accurate as a description of the design, and it is why this is not framed as a classic breach. The open question is the one Meta itself names: "how these links can be discovered."
What the statement does not address, at least in the words The Verge quotes:
- whether Meta agrees with the 6,800 figure,
- whether affected users will be told,
- whether already-published links will be disabled or rewritten,
- when sharing returns, and with what changes.
Treat any of those as unanswered until Meta says otherwise.
Why DNS is a different kind of leak
Most people think of web addresses as paths: everything after the first slash. Those can be hidden from search engines with a few settings, and an unlinked path is hard to find. A hostname is the part before the first slash, and it has to be published so browsers can find the server. Resolver logs, passive DNS datasets and certificate transparency logs all record hostnames, and some of them are searchable by anyone.
That is why putting a chat title in the hostname matters. Even if Meta had told search engines not to index the pages, the hostname itself would still sit in public records. Claroc's point, as quoted, is that this made the link reconstructable without any guessing: the title and the random ID were both already in the record.
It also explains why the count could be large. Anyone collecting hostnames at scale can filter for the Muse share domain and read off the titles, much like reading a table of contents. The reported examples, such as a loan application and a staff calendar, are consistent with titles that describe their content. Whether every one of the 6,800 links led to a live page, and how many held sensitive material, is something only Meta or Claroc's full report can answer.
Not the first time AI sharing went wrong
The Verge notes this is not new: conversations with OpenAI's ChatGPT, Anthropic's Claude and xAI's Grok have ended up on Google Search after sharing features made chats more public than intended. Meta's own earlier assistant had a similar episode in 2025, when Malwarebytes reported a bug that could have let anyone see private conversations.
The pattern is consistent. A product team adds a share button for convenience, picks a readable URL because it looks nicer in a message preview, and the readable part ends up in an index nobody was thinking about. DNS is a new vector in that pattern, because hostnames leak in places URL paths do not, such as certificate transparency logs and passive DNS datasets.
For context on how Muse treats stored data, our earlier posts cover whether Muse is safe, the filesystem export that Meta called intended behavior, and the privacy promises of personal agents.
Why this matters more for agents than for chatbots
A chat with a model is one thing. A Muse artifact can be the output of an agent that read your calendar, files or contacts, so the page you share may hold more than the sentence you typed. The staff-calendar example above is that case: the exposed item is a work product assembled from private data.
Meta pushed Muse hard, including to the top of app stores, as covered in Muse reaching number one in the App Store. Growth makes the sharing surface larger. It also means many users are new to the idea that a share link is a public page.
What to do if you ever shared a Muse chat
- Assume public. If a link was created before the pause, assume anyone could have opened it.
- Check what is in it. Look for revenue figures, loan or HR details, schedules, names and anything that identifies other people.
- Revoke or delete the shared page if the app offers it. If it does not, ask in the app's support channel and keep the date you asked.
- Rotate secrets. If a chat contained an API key, password or token, change it now.
- Do not rely on a "private" title. Titles are now known to appear in hostnames; avoid putting names or figures in chat titles on any platform that shares by link.
- Share as a file instead. Export the text and send it directly to the person who needs it.
For teams that let agents produce shareable output, the broader fix is to review what an agent can publish before it does. AgentBeam, the agent security platform from the explainx.ai team, stops AI agents before they take dangerous actions, which is the control that matters when an agent can create a public page.
What to ask Meta
- Will you publish the count of affected links and the date range?
- Will existing share URLs be invalidated and reissued without the title in the hostname?
- Will users be notified if their conversations were reachable?
- Can search engines and DNS-based crawlers be kept from discovering new links?
Lessons for anyone shipping a share button
- Keep descriptive text out of hostnames. Use an opaque, long, random token and nothing else.
- Serve shared pages with
noindexand without links from anywhere crawlable. - Offer expiry by default and a clear list of every page a user has published.
- Warn at share time when the content came from connected accounts such as calendar or email.
- Test discoverability from the outside before launch, including passive DNS and certificate logs.
Related reading
- Is Meta Muse safe? Our verdict
- Muse filesystem export: intended behavior, not a breach
- Muse dossier on contacts: the Time investigation
- AI agent privacy promises: Muse and OpenAI Dots
- Muse launch and the Sentinel VM
- Check Point and the ChatGPT sandbox Gmail leak
Details are accurate as of October 20, 2026 and rely on The Verge's report of Claroc's findings and Meta's statement. Figures are unconfirmed by Meta.