# Meta Pauses Muse Chat Sharing After Researchers Find About 6,800 Share Links Through Public DNS

Times of AI Desk · 2026-10-21 · Security

[https://timesof.ai/2026/10/meta-muse-share-links-exposed-via-passive-dns-sharing-paused](https://timesof.ai/2026/10/meta-muse-share-links-exposed-via-passive-dns-sharing-paused)

> Security firm Claroc says it found about 6,800 Muse conversation share links via passive DNS because each link's web address included the conversation title, Ars Technica reports. Opened shares included loan applications, internal revenue reviews and staff calendars. Meta told Ars and The Verge it has paused sharing while it reviews the report.

Share-by-link is only as private as the hostname design. **Security firm Claroc** says it found about **6,800** links that **Muse** users had created to share conversations, by running a passive DNS search, **Ars Technica** reported on **Tuesday, October 20**. Each share's web address included the conversation's title, and DNS monitoring services recorded those addresses once links were opened, which let outsiders find them, Claroc told Ars and The Verge.

After opening a few hundred shares, Claroc found material Ars summarises as including a small-business loan application, a marketing company's internal revenue review, a real-estate investor's performance report, a workplace's full-year staff vacation calendar, and a candidate's notes for a confidential call with a frontier AI lab.

Claroc's CTO told Ars he reported the findings through Meta's bug bounty on **Thursday, October 8** and got no reply. A Muse spokesperson told **The Verge** Meta has **paused** the sharing functionality while it reviews the report and considers changes to how the links can be discovered; Ars carried a matching Meta statement. We covered earlier [Muse KVM-escape findings](https://timesof.ai/2026/10/meta-muse-kvm-escape-vulnerabilities-pre-launch) separately.

## Limits

- Claroc's own write-up was not opened; research details are as reported by Ars and The Verge.
- Exposed-chat examples are given as categories from Ars; the underlying chats were not re-opened here.

## Sources

- [Ars Technica: Meta Muse exposes users' personal and business secrets when they share conversations (October 20, 2026)](https://arstechnica.com/security/2026/10/meta-muse-exposes-users-personal-and-business-secrets-when-they-share-conversations/)
- [The Verge: Meta pauses Muse sharing after researchers find AI chats on the web (October 20, 2026)](https://www.theverge.com/tech/1014627/meta-muse-ai-sharing-ai-chats)
- [Times of AI: Meta Muse KVM-escape vulnerabilities (October 7, 2026)](https://timesof.ai/2026/10/meta-muse-kvm-escape-vulnerabilities-pre-launch)