Meta Pauses Muse Sharing After Sensitive Chats Surface

Meta paused Muse's sharing feature after researchers found personal records and internal business documents in shared pages. The company confirmed the suspension to Ars Technica on October 20.

Claroc's GhostShares investigation identified more than 6,800 share hostnames. Researchers inspected a few hundred pages and found sensitive material in a minority. The figure does not represent 6,800 confirmed sensitive disclosures.

The exposure involved conversations users asked Muse to share, not access to every private chat. Shared pages opened without authentication. Their hostnames contained conversation titles and random identifiers, which passive-DNS services recorded during observed lookups. Researchers retrieved those names without guessing the links.

Meta said it would keep sharing paused while it reviewed the report and considered changes to link discovery. Claroc reported the issue through Meta's bug bounty program on October 8 and said researchers had no evidence of misuse.

In an October 20 follow-up, Claroc rechecked 40 previously accessible shares. None opened. Their hostnames, including conversation titles, still appeared in passive-DNS history.