Meta has disabled conversation sharing on its Muse AI assistant after security researchers at Claroc discovered that more than 6,800 shared chat URLs were publicly discoverable through passive DNS records. The feature, which let users share Muse conversations, images, and searches via web links, was paused on October 20 after researchers demonstrated that the URLs — which incorporated readable conversation titles as subdomains — could be found by anyone running DNS queries, not just the intended recipients.
How the Flaw Worked
When a Muse user shared a conversation, the platform generated a URL containing the conversation's title as part of the hostname. When recipients opened the link, their browsers looked up the hostname, and commercial passive DNS services logged those lookups. This meant that anyone with access to passive DNS data — including security researchers and, potentially, malicious actors — could discover the URLs and access the shared content.
Claroc identified more than 6,800 Muse share-related hostnames after Muse's September 8 launch. The researchers inspected several hundred of these pages and found a range of sensitive information, including a marketing company's revenue review, a small-business loan application, a property investor's financial report, a bank-fraud alert containing partial account details, an employee vacation calendar, and confidential notes about a job candidate.
Meta's Response
Meta disabled the sharing functionality while it reviews the issue and considers changes to link discoverability. After the pause, researchers confirmed that 40 previously accessible links they rechecked no longer opened. The company has not announced a timeline for restoring the feature.
Importantly, Claroc found no evidence that the exposed information had been misused. The flaw affected only conversations that users had deliberately chosen to share — not all Muse conversations — but the sharing mechanism made those links far more accessible than users would have expected.
What This Means for Companion AI Users
This incident is a warning for the entire AI chat industry, particularly for companion platforms where users share intimate, personal, or emotionally vulnerable conversations. If a similar flaw existed in a companion app's sharing feature, the consequences could be far more damaging — exposing private roleplay scenarios, personal confessions, or NSFW interactions to anyone who knew how to look.
Companion platforms including Character.AI, Replika, and Kindroid all offer conversation sharing or screenshot-sharing features. While none have reported a similar DNS-based exposure, the Muse incident demonstrates that seemingly innocuous URL-generation choices can have serious privacy implications. Users who share AI companion conversations should be aware that the privacy of those shared links depends on how the platform constructs and serves them.
The Bigger Picture
The Muse flaw is the latest in a series of privacy incidents involving AI chat platforms. Earlier this year, OpenAI's Project Lily revealed that contractors were reading real ChatGPT conversations. Anthropic exposed a network of dating apps using Claude to power scam personas. And Meta itself faced backlash in July when its Muse Image AI launched with an opt-out consent model that had to be disabled after three days.
For companion and NSFW AI users, the takeaway is clear: treat shared AI conversations as potentially public, and demand transparency from platforms about how sharing features handle URL security. The Muse pause is a reminder that in the rush to ship social features, privacy fundamentals can get overlooked — and the cost is paid by users who trusted the platform with their data.