“Anyone with the link” sharing feels private because the link is long and random. Meta’s new Muse agent showed why that’s not always true. Security firm Claroc found it could list about 6,800 Muse share links, and after opening a few hundred, it saw material clearly not meant to be public: a small-business loan application, a company’s internal revenue review, a staff vacation calendar and a to-do list containing a bank fraud alert.
Why the links were findable
As reported by Ars Technica and WIRED, every Muse share link lived on its own subdomain, and that subdomain included the conversation’s title. Subdomains are looked up through DNS, and passive DNS services record those lookups in searchable databases. So once a recipient opened a link, its address, title and all, could be found by anyone searching those records. Claroc calls these “GhostShares.”
Meta told Ars it has paused Muse sharing while it reviews the report. Claroc says it reported the issue through Meta’s bug bounty on October 8.
The five-step audit
- List your AI tools. Note every chatbot or agent people use for work, approved or not, and which ones offer public share links.
- Check how links are built. If the conversation title or any meaningful text appears in the domain part of the address (before the first single slash), treat those links as discoverable.
- Revoke old shares. Most AI tools have a “shared links” page in settings. Delete links that are no longer needed, especially ones with financial, HR or customer data.
- Set a sharing rule. Default to sharing exports or screenshots through your normal file-sharing system, which has access controls, rather than public links.
- Rename before sharing. If a public link is unavoidable, give the conversation a neutral title. “Q3 revenue review” in a URL is a gift to anyone searching.
The bigger picture
Agents like Muse need access to email, calendars and accounts to be useful. That makes small design choices, like where a title sits in a URL, much more consequential. Ask vendors how sharing works before you let an agent near business data.
Based on reporting by WIRED and Ars Technica and Claroc’s research.
