Vulnerability fixed, sharing back on
Meta reenabled the sharing feature in its Muse AI agent on October 22. Two days earlier — on October 20 — the company had temporarily suspended the feature following a report from cybersecurity firm Claroc. The problem was found in shared artifact links: URLs of documents, images, code and web apps created inside Muse could be discovered through passive DNS monitoring.
Here's how sharing works in Muse: when a user wants to share a conversation, Muse turns it into a page that opens via a link. According to Claroc, each shared item received a separate subdomain under cf.metaaiusercontent.com — the address was built from the conversation title and a random identifier. Finding the random part was nearly impossible, but that wasn't necessary: when a link is first opened, the browser queries the full hostname via DNS, and passive DNS services record these queries and keep them searchable.
The new link structure has not yet passed a full independent security review. Meta Superintelligence Labs representative David Singleton announced in a post on X that the core issue had been fully resolved, and added an important clarification: the vulnerability concerned not conversation sharing, but specifically shared artifact URLs. Meta had previously told Ars Technica it paused the feature to "review the report and study ways to discover these links."
Singleton's statement
"The core issue is now resolved, and sharing is reenabled. We immediately turned off sharing to remediate this issue — which is why shared artifacts were temporarily unavailable. We've seen some press articles about a vulnerability in chat sharing, which is incorrect — the issue was specifically with shared artifacts. If you shared an artifact before the fix, it now has a new URL. Anyone who visits the old link will see a reminder to ask you for the new one." — David Singleton, Meta Superintelligence Labs, X (October 22, 2026). Quoted by The Verge and madrobot.blog.
In his statement, Singleton apologized for the inconvenience around old links and stressed that protecting user data comes first. He said the company disabled sharing "urgently, to prevent unintended exposure."
What an artifact is and what changed
According to Meta's help page, artifacts are documents, images, code and web apps that Muse can create. They are stored inside a conversation as separate objects and get an independent link when shared. It was a design flaw in the structure of these links that allowed them to be discovered via passive DNS.
During the two-day pause, users could not share artifacts; after the October 22 announcement, the feature was fully restored. Following the fix, all shared artifacts received new URLs. Visitors opening an old link now see a reminder to ask the sender for a new link. Singleton did not detail how the new links are structured. Old links with old titles remain in passive DNS history: there is no way to remove them from history.
Earlier episode: 6,800 pages in open DNS
This story began on October 20 with Claroc's "GhostShares" report. Researchers found that links built from shared conversation titles ended up in open DNS records — a single query could surface more than 6,800 shared pages. Among them were confidential documents such as an internal revenue review of a marketing company and a small business owner's credit application.
Meta paused the sharing feature after questions from Ars Technica — more on the earlier stage of the story. In a recheck, Claroc confirmed that none of 40 shared pages opened on the day of the pause.
Attention is now on the new link structure: whether it resists the same monitoring — time will tell. The Verge's piece on the update seeks to answer exactly that question.
Bug bounty: rewards up to $300,000
In his statement, Singleton invited researchers to apply to Muse's bug bounty program. The program pays up to $300,000 for confirmed findings, every report is reviewed, and anyone who submits a finding can apply directly.
This is the latest privacy issue for Muse since its launch in September. Meta plans to deploy the agent broadly in workplaces, so the reliability of sharing mechanisms is strategically important to the company.
According to Claroc, there is currently no evidence that the discovered pages were abused, but the researchers warn that such a list could be ready-made ground for fraud.
