The pause does not take the title.
@IntCyberDigest posted at 02:01 UTC on October 21. https://x.com/IntCyberDigest/status/2112725809886539833. When I read it, that post had 354 likes, 54 reposts, 17 replies, 13 quotes, 89 bookmarks, and 34,167 impressions. The text says Muse put the titles of shared chats in their web addresses, public DNS logs picked them up, Claroc found 6,800+ of those chats with one search, from a loan application to a bank fraud alert, and Meta says it has paused sharing.
The post stops at the pause. The update on the research page does not.
The address was the title
Claroc published on October 18 and updated the same post on October 20. https://blog.claroc.io/ghostshares-muse-passive-dns/. Muse launched on September 8. Asking it to share a conversation publishes that conversation as a page and hands you a link. The page opens for anyone who has the link, with no login and no access request. Claroc says that is by design. A public page is the only way the person you send the link to can open it.
The part a stranger can search is the hostname. Muse builds each share’s web address from the share’s title, a short phrase describing the conversation, then a random ID, on cf.metaaiusercontent.com. The hostname usually gave away what a page held before anyone opened it. A hostname pulled from DNS rebuilds the link, because the link is that same title and that same ID.
DNS does the recording. The first time anyone opens the share, their browser resolves the hostname. A passive-DNS provider whose resolvers see that lookup keeps it searchable. Claroc searched one commercial dataset for hostnames under that content domain. After filtering the wildcard scan noise any domain collects, more than 6,800 share hostnames remained. They opened a few hundred and left the rest. The pages opened on sight, without an account. It took one query. They did not crawl.
The random ID was long enough that Claroc says nobody could guess it. Guessing was not the method. The first lookup publishes the ID along with the title. An ID works as a secret only while it stays off a record anyone can search. A hostname is not that kind of secret. Looking one up is how a browser finds a server.
Muse’s robots.txt asks search crawlers and AI crawlers to stay off the share paths. Claroc says that file governs crawling, not access, and their search never went near a search engine. urlscan.io, a public URL-scanning service, already held more than 75 saved scans of Muse share pages. The hostnames were in a second index that does not belong to Meta either.
They describe six pages that were not ordinary, by category, and they withhold the names, titles, figures, and links. A candidate’s notes for a confidential executive-search call with a frontier AI lab, including the lab’s internal contact and the meeting time. A national marketing company’s internal revenue review, marked for its CEO. A small-business owner’s loan application, with the amount requested. A to-do list that included a bank fraud alert, with a partial account number and a transaction amount and time. A real-estate investor’s internal performance report, with two property addresses and the return, income, and mortgage figures. A workplace’s full-year staff vacation calendar, listing dozens of employees against the week each one would be away. Most of what they opened was dull: small-business sites, listings, event calendars. The 6,800 figure is hostnames after noise filtering. It is not a count of sensitive chats, and it is not a count of users. Claroc did not contact the people or the companies, so they do not claim to know what those people meant to publish. They do say the content was plainly sensitive, and that the two companies are real, checked against public sources.
Meta’s own help page for this kind of link is not a Muse page. It is the Meta AI share page, https://www.meta.com/help/artificial-intelligence/1382777929673771/. I read it today. People with the link will be able to see your conversation. The link doesn’t expire, and people can share the link. People with the link can only see the conversation up to the point when you created the link. If you delete the link, or delete the original conversation, people who received the link won’t be able to see the conversation. Claroc calls that the closest published description Meta gives of how one of its AI share links behaves, resharing included. The page does not mention DNS. It does not mention the title becoming the hostname.
What the pause changed
Claroc reported this to Meta’s bug bounty program on October 8, with reproduction steps and example shares. They say they have no evidence that anyone misused the shares. They also say they cannot tell whether someone else found a given link first, or how long any share had been reachable. Content checks were on October 7 and 8. On October 18 they reopened one page, the call prep, to take a single redacted screenshot, and they did not reopen the others.
On October 20, after Ars Technica asked about the findings, Meta told Ars it was suspending the feature. Claroc’s update says that. I could not load the Ars page from here. TechSpot quotes Muse spokesperson Tracy Clayton, in a statement to The Verge: “People have the ability to share specific Muse artifacts, which creates a page that can be accessed by those with the link.” Then: “However, we’ve paused this functionality while we review this report and consider changes to how these links can be discovered.” https://www.techspot.com/news/114283-meta-suspends-muse-sharing-after-sensitive-documents-turn.html. The change she names is how the links can be discovered. The quote does not say Meta is deleting names a resolver already stored.
Claroc rechecked 40 shares on October 20 that had opened without an account earlier in the month. None opened. The hostnames that serve their content returned an error. The hostnames themselves, titles included, are still in passive-DNS history. The update says the rest of the write-up describes sharing as they found it before the change. Closing the page in that sample of 40 is a real change. It is a change to whether the page loads, not to whether the name is still in the dataset they searched.
The hostname is the part that stayed
Passive DNS is not a toggle in the Muse app. A resolver that saw the lookup already wrote the hostname down, title and random ID together. Pausing sharing can stop a new open of the 40 pages they rechecked. It cannot instruct a commercial DNS dataset to drop a name it indexed. The Meta AI help page says deleting a link stops people who received it from seeing the conversation. That is the same shape of control. It acts on the page. It does not un-write a title that was the address.
The title was often the sensitive line before the page was opened. Claroc says the hostname usually gave away what a page held. If the hostname says loan application, that phrase is already in the index, whether or not the page still returns an error. A meeting time in a call-prep title is a private fact in a record Meta does not operate.
If the problem is someone opening the page today, the pause is the control they turned on, for the 40 they rechecked. If the problem is the title, the pause is the wrong control. I would not put a secret in a hostname and then treat a paused feature as the deletion.