6,800 Links Found in a Single Query
Meta's Muse personal AI assistant lets users share conversations via link. Muse is the assistant the company launched in September (as we reported earlier); a page opens for anyone who has the link — no account or login required.
Cybersecurity company Claroc found a flaw in this sharing mechanism and published its research on its blog. Muse builds the web address of each shared link from the conversation title plus a random identifier (ID) under the cf.metaaiusercontent.com domain. The problem: the title lands in public DNS records, so a single passive-DNS query lists thousands of links by name. Claroc dubbed this "GhostShares".
Notably, the vulnerability isn't in guessing links — it's in how they're named. Because the conversation title is part of the address, one passive-DNS query sorts thousands of pages by title: a page's content is known before it's even opened. Over 6,800 links — the result of a single query exploiting this mechanism — all pointed to pages open to anyone with the link, with no account or login.
The researchers searched a commercial passive-DNS service for the Muse content domain. After filtering out scanning noise, more than 6,800 share links remained; several hundred were opened. The titles disclosed each page's content before opening. No link-guessing or protection-bypassing was needed — the title and ID from the DNS record led straight to the page.
What the Links Contained
Most of the opened pages were harmless: small-business sites, ads, event calendars. But some held clearly confidential data. Claroc lists six categories: a candidate's notes preparing for a secret call with a leading AI lab (with the lab's internal contact and meeting time), an internal revenue review prepared for the CEO of a national marketing company, a small business owner's loan application showing the requested amount, a bank fraud alert and a task list with a partial account number, an investor report with two real-estate addresses and exact financial figures, and the vacation schedule of dozens of employees.
The pages also existed in another public source: the public scanning service urlscan.io turned up over 75 saved scans of Muse share pages — the links were open with no account or login. Claroc's research notes that anyone with the link can view a page without creating an account.
The material found among the several hundred opened pages wasn't random files — these were documents belonging to specific people and companies, never meant for the public: the requested amount in a loan application, the internal revenue review for a CEO, the partial account number in a task list. The fact that Claroc sorted them into six categories shows how widely personal and business secrets had spread through a single open discovery channel, judging by this sample alone.
Why the Random ID Didn't Protect
The random ID in the address is deliberately long enough to be unguessable. But as Claroc notes, guessing was never the issue: when a link is first opened, the browser resolves the hostname via DNS, and the passive-DNS service records the entire name — title and ID included. An ID stays secret only while it remains secret; a hostname is no secret.
The researchers themselves stress that the figure doesn't measure the overall scale of Muse sharing: it's the result of a single discovery channel — a brief search through one hostname pattern — so the real scale could be larger.
"We call them 'GhostShares': pages opened by people who were never given the link, and which they can find on their own." — Claroc researchers
Meta Suspended the Feature
Claroc reported the findings to Meta on October 8 through its bug bounty program, and also reached out to Meta employees via LinkedIn — with no response. Only after Ars Technica covered the research did Meta announce it was temporarily suspending the conversation-sharing feature.
That development casts a shadow over Meta CEO Mark Zuckerberg's statement last month that Muse was "built from the ground up on privacy and security."
