# GhostShares: Muse share links are listed in public DNS by chat title

> GhostShares are Meta Muse shared conversations that third parties can locate through passive DNS, without ever being sent the link.

- **Severity:** Medium: Real and reproducible, but needs unusual setup, user help or a narrow audience. Plan a fix.
- **Category:** Vulnerability
- **Published by:** Claroc
- **Disclosed:** 2026-10-18
- **Affects:** Meta Muse
- **Research by:** Claroc Research Team
- **Primary source:** https://blog.claroc.io/ghostshares-muse-passive-dns/
- **Page:** https://theinjection.dev/items/claroc-ghostshares-muse-share-links/

GhostShares are Meta Muse shared-chat pages that anyone can find in passive DNS records, because Muse puts the conversation title in the share hostname. Claroc listed more than 6,800 of them. Meta has paused the sharing feature.

## What happened

Claroc published GhostShares on October 18, 2026, research showing that Meta Muse shared-conversation pages could be found by anyone with access to passive DNS data. Claroc reported the issue to Meta's bug bounty program on October 8, 2026. Meta told Ars Technica on October 20 that it was suspending the feature, and Claroc confirmed the same day that the shares it rechecked no longer opened.

## How it works

Muse builds each share address from the conversation's own title followed by a random ID, served under the content domain cf.metaaiusercontent.com. Public DNS resolvers log those lookups, so passive DNS services keep a searchable record of every share hostname, conversation title included. One query against a commercial passive DNS service returned the host list, which means a share link can be rebuilt without its owner ever sending it. Claroc says it did not guess or brute-force any address.

## Who is affected

Only Muse conversations whose owner created a share link were reachable; chats that were never shared are outside the finding. Claroc counted more than 6,800 share hostnames after filtering out wildcard DNS scanning noise, and opened only a few hundred, all of which loaded without an account. A public URL-scanning service also held more than 75 saved scans of Muse share pages.

## What to do

Ask whether staff have shared Muse conversations holding company data, and treat an AI share link as a public page rather than a private one. Claroc advises flagging public AI share links as outbound data transfers, and blocking metaaiusercontent.com at the proxy or DNS filter on managed devices where no tool can monitor the sharing. Searching passive DNS and URL-scan data for the content domains of your own AI tools shows comparable exposure.

## Quick facts

- **Affected:** Meta Muse shared-conversation pages, served under cf.metaaiusercontent.com
- **Shares found:** More than 6,800 hostnames from a single passive DNS query; a few hundred opened
- **Status:** Meta suspended the sharing feature on October 20, 2026
- **Residual risk:** Share hostnames, conversation titles included, remain in passive DNS history
- **Disclosed:** Reported to Meta's bug bounty program October 8, 2026; published October 18, 2026
- **Attack type:** Enumeration of share hostnames through passive DNS records
- **Found by:** Claroc Research Team

## Questions

### Are private Meta Muse chats exposed by GhostShares?

Only Muse conversations whose owner created a share link were reachable, according to Claroc. Private chats that were never shared are not part of the finding. Claroc opened a few hundred of the share pages and reports most held harmless material, with a minority containing sensitive personal or business content. Claroc says it found no evidence that anyone misused the data.

### Has Meta fixed the Muse sharing problem?

Meta told Ars Technica on October 20, 2026 that it was suspending the sharing feature while it reviews the report and considers changes to how the links can be discovered. Claroc rechecked 40 shares the same day and none of them opened. Claroc notes the repair is partial, because the share hostnames and their conversation titles stay in passive DNS history.

### How do I check whether my own AI tools leak share links this way?

Claroc advises searching passive DNS and URL-scanning datasets for the content domains used by the SaaS and AI tools your staff run. Any product that builds a share address out of user-supplied text will expose that text as a DNS name. Claroc also recommends treating public AI share links as outbound data transfers so that security tooling flags them.

## Sources

1. [Claroc Research](https://blog.claroc.io/ghostshares-muse-passive-dns/)
2. [Meta Sharing Help](https://www.meta.com/help/artificial-intelligence/1382777929673771/)