Sometimes the most sensitive secrets aren’t hidden behind locked doors at all. They’re sitting quietly in plain sight, waiting for someone who knows where to look. That’s essentially what a team of security researchers discovered when they started poking around Meta’s new AI assistant, Muse. The researchers, from a company called Claroc, had assumed that finding shared conversation links from Muse would take real work—hours of scanning, guessing, or crawling through obscure parts of the internet. Instead, they typed one query into a searchable database of domain records, and there it was: a list of publicly accessible pages, each one tied to a real Muse conversation, each one open to anyone who stumbled across the link. “If you had asked us beforehand, we would have guessed that gathering these would take real effort,” they later wrote. “It took one query.” The finding was alarming, not because Muse had been hacked in the traditional sense, but because the very architecture of how sharing worked made private conversations effectively findable. When Meta was asked about the issue, the company acknowledged the report and said it had paused the sharing feature while reviewing the problem. But for anyone who had trusted Muse with their personal data, the reassurance came with an uncomfortable edge: the vulnerability existed in the first place because of a series of design choices that prioritized convenience over caution.
The technical explanation for all this sounds almost absurdly simple, but it cuts to the heart of how modern internet infrastructure remembers everything. When a Muse user creates a shareable link to a conversation, that link isn’t a random jumble of characters tucked away in some obscure corner of a database. It’s a URL built around the domain name cf.metaaiusercontent.com. And because of how the internet works, the moment that link is created—and especially when someone clicks it—the domain name gets recorded in something called passive DNS. Passive DNS is like a giant, searchable diary of every domain and subdomain that has ever resolved to an IP address. It’s used by cybersecurity professionals, researchers, and sometimes bad actors to see what’s been out there, even long after the original transaction happened. The catch is that if you know a domain is used for a particular service, you can query those historical records and find every subdomain that has ever been associated with it. In the case of Muse, every shared conversation was assigned its own subdomain, and here’s the real kicker: the subdomain included the conversation’s title. So instead of a link that looked like a meaningless string of random numbers, you got something like home-sale-budget-9f21c8a3.cf.metaaiusercontent.com or q3-revenue-review-7b1e42f0.cf.metaaiusercontent.com. The title wasn’t hidden in the URL path, where only the person who clicked the link would see it. It was right there in the domain name itself, permanently recorded in public DNS history for anyone with the right tool to find.
The researchers called these pages GhostShares, and the name is perfect. A GhostShare is a page that opens for people who were never handed the link, and that those people can find entirely on their own. It’s not a traditional security breach in the sense of someone breaking into a server. There was no password cracking, no exploiting of a memory corruption bug, no malicious code injection. The doors were simply left open, and the address was written on the front of the building. To understand why this is so serious, you have to think about what those links contain. Muse isn’t just a chatbot that answers trivia questions. It’s a deeply personal assistant that can help with things like drafting a loan application, planning a home sale budget, or reviewing quarterly revenue. These are conversations that people would reasonably assume are private. Yet because of the way the share links were constructed, anyone could search DNS records, find the subdomains, and open the conversations without any authentication at all. The Claroc researchers emphasized that plenty of other AI assistants also share by public link, but most of them don’t make it this easy to discover the links. The problem wasn’t the concept of sharing; it was the decision to put the conversation title inside the web address, where public DNS records would remember it forever. It’s the difference between handing someone a sealed envelope and writing the entire letter on the outside of the envelope in permanent ink.
To step back for a moment, it’s worth remembering just how much hype and trust surrounded Muse from the very beginning. When Meta launched the assistant, it quickly shot to one of the top spots in Apple’s App Store. The promise was tantalizing: an AI that could autonomously fill out forms, book appointments, make purchases, create documents, and carry out all kinds of other tasks on your behalf. To do any of that, Muse needed access to a staggering amount of personal information. It needed access to most of a user’s accounts—email, calendars, financial services, shopping apps, maybe more. Meta leaned heavily into the idea that this was a platform worthy of extraordinary trust. The entire selling point was that you could hand over the keys to your digital life and let the AI handle the tedious stuff. But trust is a fragile thing, and it has to be earned through careful engineering, thoughtful security defaults, and a willingness to admit when something goes wrong. The GhostShares discovery was a direct challenge to that trust. It suggested that Meta, at least in this case, had prioritized a smooth sharing experience over the basic principle that private conversations should stay private. The fact that the vulnerability was so easy to exploit made it even worse. You didn’t need to be a sophisticated hacker to find these conversations. You just needed to know where to look.
And this wasn’t the first warning sign. Just three weeks after Muse launched, macOS security expert Patrick Wardle found a separate zero-day vulnerability that allowed any other app installed on the same device to gain complete control of a user’s Muse account. That was a serious issue in its own right, but Meta downplayed it, arguing that exploitation wasn’t possible unless a device was already compromised. The company didn’t really acknowledge Wardle’s finding that a simple ClickFix attack—a social engineering trick that tricks users into pasting malicious commands—was all it took to hijack an account. In other words, the barrier to entry wasn’t as high as Meta wanted people to believe. Taken together, these two incidents paint a concerning picture. It’s not that Meta is maliciously trying to expose user data. It’s that the company seems to be moving fast, shipping features, and treating security as an afterthought. When a product requires the level of access that Muse demands, the margin for error shrinks dramatically. A vulnerability that might be a minor annoyance in a simple chat app becomes a serious threat when it exposes loan applications, medical discussions, or business secrets. The GhostShares issue, in particular, felt like a failure of imagination: someone on the Muse team probably thought it would be helpful to put the conversation title in the URL so that users could recognize their shared links at a glance. But they didn’t think about the fact that those URLs would be indexed in DNS records, or that the internet has a very long memory.
For now, the immediate danger has been defused. Meta paused the sharing functionality while it reviews the report and considers changes to how the links can be discovered. That means Muse users no longer face the specific threat of their shared conversations being found through passive DNS searches, at least for the moment. But the broader questions remain unanswered. How many other AI assistants, both from Meta and from other companies, are making the same kinds of mistakes? How many of them are storing sensitive data in ways that seem private on the surface but are actually discoverable by anyone with the right tools? And perhaps most importantly, can any AI assistant that requires this level of access ever truly be secure? The answer isn’t necessarily no. There are ways to build sharing systems that don’t leak metadata, ways to ensure that even if a URL is exposed, it can’t be guessed or found by searching public records. Random tokens can be placed in the URL path instead of the subdomain. Links can require authentication before opening. Access can be revoked after a certain amount of time. All of these are well-known techniques, and none of them are particularly hard to implement. What they require is a mindset that treats user privacy as a foundational requirement rather than a nice-to-have feature. The story of Muse’s GhostShares is a reminder that in the race to build the most helpful, most autonomous AI assistant, the most important thing to protect is the human on the other side of the screen. Until companies like Meta prove that they can handle that responsibility, users should think carefully before handing over the keys to their digital lives.
