Direct answer: Researchers at security firm Claroc found that sharing a conversation in Meta’s new Muse AI assistant created a web link anyone could discover — they pulled up 6,800 shared chats with a single passive-DNS query, including a small-business loan application and a company’s internal revenue review. Meta has suspended the sharing feature while it investigates.
What happened
Meta’s Muse assistant — which rose to the top of Apple’s App Store after launch and was described by Mark Zuckerberg as “built from the ground up for privacy and security” — lets users share searches, conversations and images through unique web links. The catch, reported by Ars Technica on 20 October 2026, is in how those links were built: the conversation title was embedded in the URL itself, as a subdomain under cf.metaaiusercontent.com (something like home-sale-budget-9f21c8a3.cf.metaaiusercontent.com).
Passive DNS services quietly record the addresses devices visit. Because the titles sat in the subdomain, a single passive-DNS query was enough for Claroc to enumerate 6,800 shared Muse pages — and many contained clearly sensitive material. The researchers dubbed them “GhostShares”: pages that open for people who were never given the link.
The examples Claroc described are sobering for anyone running a business: a candidate’s notes for a confidential executive-search call with a frontier AI lab (naming the internal contact and meeting time), a national marketing company’s revenue review marked for its CEO, a small-business owner’s loan application with the requested amount, a to-do list containing a bank fraud alert with a partial account number, a real-estate investor’s report with property addresses and exact return figures, and a workplace’s full-year staff vacation calendar listing dozens of employees.
This is the second privacy black eye for Muse in weeks. Roughly three weeks after launch, macOS security expert Patrick Wardle found a zero-day that let any other app on the device take over a user’s Muse account; Meta downplayed it, saying exploitation required an already-compromised device, without addressing Wardle’s finding that a simple ClickFix-style attack could hijack an account.
Meta responded a couple of hours after the article went live, saying it opened the Muse bug bounty programme so researchers could raise scenarios like this, that sharing “creates a page that can be accessed by those with the link,” and that it has paused the functionality while it reviews the report and considers changes to how shared links can be discovered.
What it means for UK small businesses
If you or your team use AI assistants for real work — drafting proposals, analysing customer feedback, preparing accounts — this story is aimed squarely at you. UK businesses are covered by the UK GDPR, and a shared chat containing customer names, financial figures or staff data can become a reportable personal-data breach very quickly. The ICO doesn’t care that the leak came from a “share” button you thought was private.
Three practical takeaways:
- Treat every AI prompt as potentially public. If you wouldn’t email it to a stranger, don’t paste it into a free AI assistant — and definitely don’t share the resulting conversation.
- “Share with link” is never private-by-default. Whether it’s an AI chat, a Google Doc or a Loom video, anyone-with-the-link means anyone who finds the link. Use workspace accounts with proper access controls instead.
- Write it down. A one-page AI use policy for your team that spells out what staff may and may not feed into AI tools is now a business basic, not a nice-to-have.
If your team uses AI with customer data, it’s also worth reading our UK GDPR guide for AI use in small business to see where the compliance lines sit.
Honest limits / what to watch
A few caveats before anyone panics. Claroc’s research shows the links were discoverable — it doesn’t claim Meta indexed private conversations or that millions of chats are exposed. 6,800 pages is a sample, not the total population. Meta has already paused sharing, which limits new exposure, though already-discovered links may still resolve. And this is about shared artifacts only: conversations you never shared are not implicated by this report.
What to watch: whether Meta re-enables sharing with genuinely unguessable links (long random tokens instead of descriptive subdomains) or with link expiry and access controls — and whether the ICO or other regulators ask questions about UK users affected. If Meta’s fix is just “we paused it,” the underlying design lesson stands for every AI tool your team touches.
FAQs
What happened with Meta’s Muse share links?
Muse lets users share conversations and searches through web links. Security firm Claroc found those links were discoverable through passive DNS records, because the conversation title is embedded in the share URL’s subdomain — a single query surfaced 6,800 shared pages.
What are “GhostShares”?
Claroc’s name for shared Muse pages that open for people who were never handed the link. Anyone who could guess or find the address could read the conversation, even though the user only meant to share it with one recipient.
What kind of information was exposed?
Claroc says examples included a small-business owner’s loan application with the amount requested, an internal revenue review marked for a company’s CEO, a to-do list with a bank fraud alert and partial account number, property addresses with exact financial figures, and a full-year staff vacation calendar.
Has Meta fixed the problem?
Meta told Ars Technica it has paused the sharing functionality while it reviews the report and considers changes to how shared links can be discovered. No permanent fix has been announced yet.
Should my UK business worry about this?
Yes — if anyone on your team pasted customer data, financials, or staff details into an AI assistant and shared the chat, that content may have been reachable. It’s a reminder to treat every AI conversation as potentially public and keep sensitive data out of prompts.
How can businesses share AI work safely?
Avoid pasting real customer names, account numbers, or internal figures into AI tools; use workspace or enterprise tiers with data controls; and keep a written AI use policy that says what staff may and may not feed into AI assistants.
