Privacy Breach: Meta's Muse AI Leaks Private User Data via "GhostShares"

By Dan Goodin | October 20, 2026

Meta has been forced to disable the conversation-sharing functionality of Muse, its latest general-purpose AI agent, after security researchers discovered a flaw that exposes sensitive personal and corporate secrets.

The Vulnerability: How "GhostShares" Work

While Muse allows users to generate unique URLs to share their AI interactions, the way these links are constructed creates a massive privacy hole. Typically, services use long, random strings to prevent "guessing" URLs. Muse does this, but it makes a critical design error: it places the conversation's title directly into the subdomain.

The Technical Breakdown

The structure of a Muse share link can be represented mathematically as: $\text{URL} = \text{Conversation Title} + \text{Random Hash} + \text{Meta Domain}$

Because the title is part of the subdomain, it is recorded by passive DNS (pDNS) systems. These systems monitor DNS responses from recursive resolvers to maintain historical records of domain resolutions. Once a legitimate recipient clicks a link, the record is etched into searchable pDNS databases.

Researchers from the security firm Claroc utilized this method to enumerate approximately 6,800 unique sharing links. They dubbed these "GhostShares"—pages accessible to anyone who knows how to look, even if they were never intended to see the content.

Evidence of Exposure

After auditing several hundred of these discovered links, Claroc found a treasure trove of private data. The following table highlights the types of sensitive information leaked:

"If you had asked us beforehand, we would have guessed that gathering these would take real effort," the Claroc team noted. "It took one query."

Meta's Response and the "Privacy" Paradox

Meta CEO Mark Zuckerberg previously claimed that Muse was "built from the ground up for privacy and security." However, the reality suggests otherwise.

In a statement to Ars Technica, Meta acknowledged the issue:

"We opened the Muse bug bounty program so researchers could raise different scenarios and help us continue improving the product... we’ve paused this functionality while we review this report and consider changes to how these links can be discovered."

Asaf Aprozper, CTO of Claroc, mentioned that he reported the flaw via the bug bounty program on October 8 and attempted to contact Meta staff via LinkedIn, but received no initial response.

A Pattern of Security Concerns

The "GhostShares" incident is not the first red flag for Muse. The AI agent is designed for deep integration, requiring extensive access to user accounts to perform tasks such as:

• Filling out digital forms
• Scheduling appointments
• Executing purchases
• Generating complex documents

Shortly after launch, security expert Patrick Wardle identified a zero-day vulnerability. This flaw potentially allowed any app on a user's device to seize total control of their Muse account. Meta attempted to minimize this, arguing that the device would already need to be compromised for the attack to work. However, Wardle countered that a simple ClickFix attack could be sufficient to hijack an account.

Example of a Vulnerable URL Structure:

The researchers found that links followed this predictable pattern: home-sale-budget-9f21c8a3.cf.metaaiusercontent.com q3-revenue-review-7b1e42f0.cf.metaaiusercontent.com loan-application-draft-a4c9e2.cf.metaaiusercontent.com

By searching for the domain cf.metaaiusercontent.com in passive DNS logs, the "secrets" of thousands of users were laid bare.