On October 20, Meta told Ars Technica it had paused Muse’s sharing feature while reviewing Claroc’s report and considering changes to how share links could be discovered. Claroc’s findings concerned pages created for conversations users chose to share.
NeoTeo previously covered a separate report about Muse profiles built from information in users’ messages. This incident concerns how shared conversation pages could be found.
Why Muse share links could be found through passive DNS
Claroc said a Muse share hostname contained the conversation title, a random ID, and the cf.metaaiusercontent.com domain. When someone opened a shared page, a DNS lookup could expose that full hostname to passive-DNS services, which keep records of observed hostnames that can later be searched. Because the title was part of the hostname, the random ID did not hide it.
What Claroc found in the pages it opened
Claroc said its content checks on October 7 and 8, 2026, found more than 6,800 share hostnames in one commercial passive-DNS dataset, after it filtered out wildcard-DNS scan noise. The researchers opened a few hundred pages; a minority contained sensitive personal or business information. Examples included executive-search preparation, internal business material, a loan application, a bank-fraud alert, real-estate figures, and a staff vacation calendar.
The hostname count came from one dataset and one hostname pattern over a short period. Claroc said its work did not measure total Muse exposure or how long individual shares had been reachable. It also said it found no evidence of misuse.
Claroc’s October 20 recheck covered 40 shares
On October 20, Claroc reported that none of 40 shares it had previously accessed opened during its recheck. Their hostnames and titles remained in passive-DNS history.
