# Meta pauses Muse sharing after researchers find chat pages through passive DNS

> Meta paused Muse conversation sharing after Claroc found thousands of readable share hostnames in passive DNS. Claroc's October 20 recheck found 40 older pages no longer opened, while their titles remained in DNS history.

By BIG CHANGE Editorial

Published: 2026-10-21T11:55:40.583Z
Updated: 2026-10-21T11:55:40.583Z
Canonical: https://bigchange.ai/blog/meta-muse-sharing-passive-dns-suspension

![Conceptual charcoal illustration of an unbranded wall-mounted monitor showing empty chat shapes and an orange segment in a blank browser address field.](https://bigchange.ai/api/media/file/meta-muse-share-address-hero-v1.png)
AI-generated conceptual illustration by BIG CHANGE.

Meta has paused Muse's conversation-sharing feature after security researchers found that public share pages could be discovered through a passive DNS search. People had deliberately created the pages to share conversations. The problem was that Muse put each conversation's readable title and share ID in a hostname that a DNS monitoring service could record and make searchable. Meta told Ars Technica on October 20 that it was reviewing how the links could be discovered.

## The big change

- **What changed:** A Muse share link offered access to a conversation without a login. Claroc found that its hostname also gave people who had never received the link a way to discover it. Meta has since paused sharing while it reviews the design.
- **Why it matters:** Claroc says some of the pages it opened in October contained personal records and internal business material. A person creating a share link might not realize that a searchable DNS record could expose its title and address to someone who was never sent the link.
- **What to watch:** Claroc's October 20 recheck found that 40 formerly accessible shares no longer opened, but their titles remained in passive DNS history. Meta has said it is considering changes to discoverability; the sources do not establish when sharing will return or what will happen to those historical records.

## How a link became findable

In its [GhostShares investigation](https://blog.claroc.io/ghostshares-muse-passive-dns/), Claroc describes a share page that opened to anyone with its URL, without a Muse account. That access was the intended behavior of a public share link. Claroc's finding concerns discovery: Muse put the conversation title and a random share ID in the subdomain serving the page. A browser looking up that hostname can leave a record with a passive DNS provider. Such providers collect observed domain lookups and let customers search their records. Claroc searched one commercial dataset for Muse's content domain and retrieved readable share hostnames, including the IDs needed to reconstruct links. It says it did not guess IDs or force access to pages.

The distinction matters because a hard-to-guess ID helps only while the full address stays out of view. A link sent to a colleague can be observed by a DNS service when opened. Claroc says Muse's `robots.txt` discouraged search crawlers from visiting share paths, but its discovery method did not use a search engine. That file does not control who can open a page whose address is known.

## What Claroc measured, and when

Claroc says its collection and content checks took place on October 7 and 8, 2026. After filtering scan noise from a commercial passive DNS search, it counted more than 6,800 Muse share hostnames. It opened a few hundred, not all 6,800. Most of the pages it inspected were unremarkable; a minority included material such as a loan application, an internal revenue review and preparation for a confidential executive-search call. The researchers say they reached those pages without an account and did not contact the people or companies involved. Their count describes one dataset, one hostname pattern and a short collection window. It does not measure every Muse share or prove that an unauthorized person used the material.

Claroc reported its findings to Meta's bug bounty program on October 8. Its report was first dated October 18 and updated October 20. The team says its content checks took place on October 7 and 8, apart from reopening one page on October 18 to capture a redacted screenshot. In the October 20 update, Claroc says it rechecked 40 shares that had previously opened without an account: none opened then, and their content hostnames returned an error. The readable hostnames remained in passive DNS history. Those are Claroc's observations, not a fresh BIG CHANGE test of current access.

[Ars Technica reported](https://arstechnica.com/security/2026/10/meta-muse-exposes-users-personal-and-business-secrets-when-they-share-conversations/) on October 20 that Meta had paused the sharing feature in response to its questions. Meta said that people could create pages accessible to those with a link and that it was reviewing Claroc's report and considering changes to how links could be discovered. Meta's statement describes a feature pause; it does not give a date for its return or a complete account of whether every earlier share has been removed.

## What a user or security team can check

People who remember creating a public Muse share should consider whether that conversation contained sensitive material. A team can ask people using Muse whether they created public share links for work material and check any records the team already has of those links. Claroc's findings show why an unlisted link should be treated as public once created: someone with the address could open the page during its October checks, and passive DNS made some addresses searchable. The October 20 recheck narrows the current access claim, but it does not erase the historical hostname record.

Meta's [help page for Meta AI sharing](https://www.facebook.com/help/463983701520800), captured by Claroc on October 18, said that people with a link could view a conversation and reshare the link. That page describes Meta AI sharing generally, not Muse's specific controls, and it was not accessible to us without a Facebook login on October 21. Readers should not treat it as confirmation that a Muse deletion control exists or that an old Muse link currently works. Claroc says it has no evidence of misuse. Its investigation establishes discoverability and its own dated access checks, not what any other party did with the pages.

## Sources & further reading

- [Claroc Research, “GhostShares”](https://blog.claroc.io/ghostshares-muse-passive-dns/) (published October 18, updated October 20, 2026): the original passive DNS investigation, its sample and dated access checks, disclosure timeline and October 20 recheck. Claroc did not measure every share and reports no evidence of misuse.
- [Ars Technica, “Meta Muse exposes users’ personal and business secrets when they share conversations”](https://arstechnica.com/security/2026/10/meta-muse-exposes-users-personal-and-business-secrets-when-they-share-conversations/) (October 20, 2026): original reporting that obtained Meta's statement about pausing sharing and reviewing link discoverability.
- [Meta AI help, “Share a link or delete a link you shared to a conversation you had with Meta AI”](https://www.facebook.com/help/463983701520800) (Claroc capture dated October 18, 2026): background on Meta AI's general link-sharing model. It is not Muse-specific; our October 21 access attempt reached a Facebook login/block page.

## Sources

- [Claroc Research, GhostShares report, updated Oct. 20, 2026](https://blog.claroc.io/ghostshares-muse-passive-dns/) — Original investigation, published October 18 and updated October 20. Establishes the passive DNS mechanism, filtered 6,800-plus hostname count, sample, October 7–8 content checks, October 8 disclosure, no known misuse, and October 20 recheck of 40. One provider and one hostname pattern; not total exposure.
- [Ars Technica report on Meta suspension, Oct. 20, 2026](https://arstechnica.com/security/2026/10/meta-muse-exposes-users-personal-and-business-secrets-when-they-share-conversations/) — Original October 20 reporting that obtained Meta's statement about pausing sharing and reviewing link discoverability. Does not establish a return date or the status of every old link.
- [Meta AI help on sharing, captured Oct. 18, 2026](https://www.facebook.com/help/463983701520800) — General Meta AI sharing help captured by Claroc October 18, not Muse-specific. BIG CHANGE's October 21 direct access reached a Facebook login/block page; live help text was not verified.