Meta Muse Chat Titles Exposed 6,800 Share Links in DNS

Security firm Claroc found more than 6,800 shared Meta Muse chats listed by title in public DNS records, and Meta has paused chat sharing.

If you run a store, this lands on your desk because of what you paste into AI assistants: dealer cost sheets, supplier price lists, loan paperwork, customer exports. Share one of those chats from Muse and, per Claroc, the chat title became a public web address that anyone could look up. That is a real exposure for any owner running the high-ticket model we teach at Ecommerce Paradise, where the gap between your cost and your retail price is the whole business.

Below: what Claroc found, why Meta’s design made it possible, what it can cost a high-ticket operator, and a short audit you can finish this week on every AI tool your team touches. I covered Muse’s shopping side earlier in my post on Muse checking out with Shop Pay. This is the other side of the same product.

When a leaked document names your store, you want an LLC between that paper and your personal assets, so form your LLC with Northwest Registered Agent, the best LLC formation service for ecommerce owners. The address on an LLC filing is where plaintiffs and regulators look first, and Northwest puts its own registered agent address on your public filings instead of yours. Form your LLC with Northwest →

Claroc Found 6,800+ Muse Share Links Listed in Public DNS

Meta launched Muse, its AI agent app, on September 8, 2026, according to Claroc’s research report. About a month later, Claroc’s team ran a search of a commercial passive-DNS dataset for hostnames under the domain Meta uses for Muse content, cf.metaaiusercontent.com. After filtering out wildcard-DNS scan noise, they were left with more than 6,800 share hostnames, per Claroc’s GhostShares report dated October 18.

Here is the mechanism. When you share a Muse conversation, Muse publishes it as a web page that opens without a login. It builds the page’s address from the conversation title plus a random string. When anyone opens that address, the lookup is recorded by passive-DNS providers and stays searchable. So the random string protected nothing, because the readable title sat in the hostname that the DNS record exposed.

Claroc opened only a few hundred of the pages, in a logged-out browser, and did not log in, submit forms or upload anything. It also found more than 75 saved Muse share scans on urlscan.io. It described six sensitive examples by category only: preparation notes for a confidential call with a frontier AI lab, a marketing firm’s internal revenue review addressed to its CEO, a small-business loan application with the requested amount, a to-do list with a bank fraud alert and a partial account number, a real-estate investor’s performance report with property addresses and financial figures, and a workplace’s full-year vacation calendar.

The timeline matters for how much to worry. Claroc reported the flaw to Meta’s bug bounty program on October 8. According to AndroidPure’s account of the sequence, Claroc’s CTO, Asaf Aprozper, said he got no reply, even when he tried LinkedIn. On October 20, after Ars Technica asked Meta about the findings, a Meta spokesperson said, per The Verge as quoted by that outlet: “we’ve paused this functionality while we review this report.” Meta also said it is considering changes to how the links can be discovered.

What remains unsettled is the cleanup. Claroc rechecked 40 shares that had opened without an account earlier in the month, and on October 20 none of the 40 opened, according to Unite.AI’s write-up. Claroc calls that a sample, not proof that every page is gone. Meta has not said whether links will come back, and AI Weekly notes it is unclear whether the roughly 6,800 existing shares will be invalidated. The titles also remain in passive-DNS history, and Claroc saw 27 new share hostnames on the last day it checked.

Two limits on the story. Claroc says it found no evidence anyone misused the shares, and it did not contact the affected people or companies. And most of the pages it opened were harmless, per AI Weekly. This is an exposure, not a confirmed breach with victims.

Why Meta’s Muse Share Pages Were Public by Design

Nobody hacked Muse. Claroc’s point is that the feature worked as built. Muse “shares only by link,” in Claroc’s paraphrase, so a public page is the only way the teammate you send it to can open it. Meta’s own help page says people “with the link will be able to see your conversation,” and that page covers Meta AI generally, not Muse specifically, Claroc notes. The authors add that looking up a hostname “is just how the web works.”

The gap is between what users assume and what the system does. Meta has promoted Muse heavily on privacy. Per Slashdot’s summary of the Ars Technica report, Mark Zuckerberg said Muse was “built from the ground up for privacy and security.” A share button that creates a public page whose title is searchable in DNS is not what most people picture when they click it. The Slashdot summary also flags that the example URL formats in coverage, like a home-sale budget title, are illustrations of the pattern and not confirmed leaked content, so read the Slashdot item as a pointer to the primary reporting.

There is precedent for Meta’s AI products and oversharing. A 2025 report on the earlier Meta AI app, summarized by AlternativeTo, described private conversations appearing in a public feed after users hit Share, with only a small disclaimer. That article does not carry a publication date I could confirm, so treat the timing as approximate. The pattern is the same: a share action with a bigger audience than the user expected.

Muse also sits inside a product push that matters to merchants. Meta has been opening it to commerce, and I tracked that in my post on PayPal opening checkout to Muse. Meta’s terms that let it crawl business websites from Oct. 30 are the other half. A platform that wants to be your customer’s shopping agent and also your store’s crawler is a platform whose data habits deserve scrutiny.

What a Searchable Chat Title Costs a High-Ticket Operator

My read is that this is a bigger deal for high-ticket dropshippers than for the average Muse user, for one reason: your edge lives in documents you are tempted to paste into an assistant. Authorized dealer agreements, MAP policies, wholesale cost sheets, freight quotes, supplier contacts. Say you sell $3,000 to $12,000 items on a 20 to 30 percent gross margin, the range I describe in my guide to high-ticket dropshipping. One supplier relationship can then be worth more than your ad account.

Take a hypothetical, labeled as such. You paste a dealer cost sheet into an assistant and ask it to build a pricing table. You share the chat with your VA, and the title the tool generates is something like “dealer-cost-sheet-fall-2026.” In a design like the one Claroc describes, that title is now a hostname in passive DNS. A competitor searching for your niche’s brand names could find it. The damage is not abstract: your cost, your margin and your supplier’s MAP floor are on a public page, and the supplier may read your agreement’s confidentiality terms very differently than you do.

The second exposure is financial paperwork. Claroc’s examples included a small-business loan application and a to-do list with a partial account number. If you use an assistant to polish a loan application or reconcile a bank alert, that material is exactly what lenders and fraud teams tell you to protect. Banks already treat AI agents as a risk. See my coverage of Citi and BofA restricting AI agents for how seriously the big institutions take it.

The third is customer data. A pasted order export has names, addresses and phone numbers. The FTC’s guide Protecting Personal Information: A Guide for Business tells companies to take stock of the personal data they hold, keep only what they need, and lock it down, including oversight of the service providers and contractors who touch it. A shared chat full of customer rows fails all three. I am not your lawyer, and whether a given paste triggers a notification duty depends on your state and the data, so ask counsel before you assume either way.

Scenarios, with thresholds. If you never used Muse sharing, your direct exposure from this event is zero, and your job is to check the other tools. If you used it and only shared generic drafts, your exposure is small once you delete the links. If you shared anything with supplier pricing, customer rows or account details, assume it was findable until proven otherwise. Rough scale: 6,800 hostnames across roughly 30 days since launch averages about 227 a day, my division and not a Claroc figure. If your team shares a handful of chats a month, the odds that any one is in that set are low. The cost if it is, though, is lopsided.

Also watch the people layer. VAs share chats constantly, because it is the easiest way to hand a task across time zones. If you hire through OnlineJobs.ph, which I do recommend for support and listing work, put an AI-use rule in the onboarding doc. OnlineJobs.ph gets you the person, but the policy is on you. And vet who you give access to, as I argued in my post on North Korean IT workers hitting 70+ US firms.

This also feeds a bigger shift. Shoppers and agents are starting to transact through AI surfaces, and the data trail those surfaces leave is part of your risk surface. Arkose found that 97.7% of legitimate AI agent sessions lack verified ID. Separately, no Shopify store in a 122-store sample passed all nine AI-agent readiness checks. You do not need to be afraid of AI. You need a data policy before the tools outrun your habits.

If you would rather not run supplier relationships, VAs and a store all by yourself, my team can build and run the store for you. See the turnkey done-for-you service and keep your own attention on the decisions that matter.

Your supplier relationships are the asset, so let my team build and run the high-ticket store while you protect them. See the turnkey done-for-you service →

Audit Your AI Chat Share Links in Six Steps

Here are the six moves I would make this week. None needs a developer.

Delete every Muse share link you created. Open Muse, find your shared conversations and remove the links. Meta says deleting a link cuts off access for people who received it, though Claroc’s note that DNS history persists means the title may remain searchable. Do it anyway, because deletion is the one control Meta documents.
Check the share settings in every other assistant. Open the data controls in ChatGPT, then do the same in any other tool your team uses, and look for shared or public links. If your team works in Claude, check there too. Revoke the ones you do not need. I have not tested how each vendor names this setting in its latest release, so look for the words “share” or “public link” in the data or privacy menu.
Write a one-page rule for what never goes into a chat. My list for a high-ticket store: dealer agreements, wholesale cost sheets, MAP policies, customer exports, bank and card details, loan files. Keep customer notes in your CRM, such as HubSpot, not in a prompt. Keep subscriber lists in your email platform, for example Klaviyo. The free CRM setup is in my HubSpot walkthrough.
Move money documents back to the systems built for them. Keep statements and loan paperwork in your bank portal, for example your Mercury account. Keep your books in a bookkeeping tool like Finaloop.
Brief every VA and contractor on the rule, in writing. Have them confirm they read it. Put “no public share links” in the SOP, and spot-check a sample of their chats each month.
Search for your own exposure. Claroc suggests checking passive DNS and urlscan for the content domains of the AI tools your staff use. Search your brand, your supplier names and your product lines. If you want a second pair of eyes on your setup, book a call at my discovery page.

Also sweep your own store’s security basics while you are in there. Review your installed apps, as I laid out in my post on three hijacked Shopify apps. Your Shopify admin is where your customer data lives, so that is the system to protect first.

Frequently Asked Questions

Did Meta Muse get hacked?
No. Per Claroc, the share feature worked as designed: a public page with an address built from the chat title. The exposure came from passive DNS recording the hostname when pages were opened, not from an intrusion.

Is Muse chat sharing still available?
Not for now. A Meta spokesperson said it paused the functionality while it reviews Claroc’s report, and Meta has not said whether sharing will return. Check Meta’s own announcements before you rely on it.

Were my chats exposed if I never shared them?
Based on Claroc’s description, only chats that were shared created public pages. Unshared conversations are not part of the findings, though I would still keep sensitive paperwork out of any assistant you have not vetted.

Does the same risk apply to ChatGPT or Claude?
Claroc’s findings are about Muse’s URL design, not those tools. Still, any feature that makes a chat visible by link deserves a check, so review shared links in ChatGPT as well. My guide on building a leaner high-ticket business with Claude shows how I think about using AI inside a store.

What should I do if a supplier document was in a shared chat?
Delete the link and read your dealer agreement for confidentiality terms. If the document held customer data or account numbers, talk to a lawyer or your accountant about notification duties. I am not a lawyer or financial advisor.

Should high-ticket stores stop using AI assistants?
No. The fix is a data policy, not a ban. Put the rules in place before you add suppliers. If you are still choosing what to sell, grab the free high-ticket niches list. The long version is in my niches guide.

Where do I get help setting up the business side?
If you are forming an entity or cleaning up your records, my 1-on-1 coaching covers it. My guide to a business address without renting an office helps keep your home address off public paperwork.

Want to work through your AI data rules with other store owners and me inside the community? Join the Skool community →

That is the read for now. Muse is paused, but the habit of pasting your most valuable documents into a chat box is not going anywhere, so fix the habit. Subscribe to the YouTube channel for daily breakdowns. More breaking news coming through the day.

If this was useful, these go deeper:

Trevor Fenner

Trevor Fenner is an ecommerce entrepreneur and the founder of Ecommerce Paradise, a platform focused on helping entrepreneurs build and scale profitable high-ticket ecommerce and dropshipping businesses. With over a decade of hands-on experience, Trevor specializes in high-ticket dropshipping strategy, niche and product selection, supplier recruiting and onboarding, Google & Bing Shopping ads, ecommerce SEO, and systems-driven automation and scaling. Through Ecommerce Paradise, he provides free education via in-depth guides like How to Start High-Ticket Dropshipping, advanced training through the High-Ticket Dropshipping Masterclass, and fully done-for-you turnkey ecommerce services for entrepreneurs who want a faster, more hands-off path to growth. Trevor is known for emphasizing sustainable, real-world ecommerce models over hype-driven tactics, helping store owners build scalable, sellable, and location-independent brands.