/
← Voltar ao feed
high technology consumer

GhostShares: Meta Muse AI share links expose ~6,800 private chats via passive DNS; Meta suspends sharing

2 fonte(s) · 2 atualização(ões) · publicado 21/10/2026 07:22 · coletado há 3 horas

Matéria consolidada. Reúne 2 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 2 fontes trouxeram em 21/10/2026 12:00; os links antigos trazem para cá.

Fontes: wired.com ↗ gbhackers.com ↗

Researchers at Claroc disclosed GhostShares, a design flaw in Meta's Muse AI assistant that lets anyone discover shared conversations through passive DNS. Muse share links use the domain cf.metaaiusercontent.com and embed the conversation title and a random identifier in the hostname. Once a browser resolves the name, passive DNS sensors record it, and the link can be rebuilt from the record. Claroc enumerated more than 6,800 share hostnames (after filtering wildcard DNS noise) and opened only a few hundred pages, some with personal financial data and confidential business material. Claroc reported the issue through Meta's bug bounty on October 8 and, per wired.com, got no reply. Meta then paused the sharing feature, and told Ars Technica on October 20 that it was suspending it (gbhackers.com). The researchers found no evidence of misuse, but historical DNS records still retain the hostnames.

Timeline

  • 2026-10-08 - Claroc reports the issue through Meta's bug bounty program; wired.com says it received no reply (wired.com, gbhackers.com).
  • 2026-10-20 - Meta tells Ars Technica it is suspending the Muse sharing feature (gbhackers.com). Claroc rechecks 40 previously accessible shares and none open, though passive DNS still holds the hostnames and embedded titles (gbhackers.com).
  • 2026-10-21 - Public disclosure of GhostShares. Meta is reported to be reviewing the report and considering changes to how links can be discovered (wired.com, gbhackers.com).

Technical Details

  • The issue is discoverability, not unauthorized access to private accounts. Muse intentionally published conversations when users chose to share them (gbhackers.com).
  • The access token (random identifier) and descriptive metadata (title) sit in the hostname, so they enter DNS and passive DNS historical datasets when resolved. Claroc says the root cause is placing the title in the subdomain instead of the URL path (gbhackers.com, wired.com).
  • Simplified example from wired.com: loan-application-draft-a4c9e2.cf.metaaiusercontent.com.
  • Claroc enumerated about 6,800 links with a single query (wired.com). It reconstructed links without guessing identifiers, brute forcing, or signing in to Muse. Sampled pages opened in ordinary and logged-out incognito sessions (gbhackers.com).
  • Sampled content included a home sale budget, a bank fraud alert with a partial account number, a small business loan application, a CEO-restricted revenue review, property investment figures, employee vacation schedules, and confidential preparation for an executive search conversation with a frontier AI laboratory. Meeting details and named contacts could support targeted impersonation or social engineering (gbhackers.com, wired.com).
  • Claroc also reported more than 75 saved Muse scans on urlscan.io (gbhackers.com).
  • Muse discouraged crawlers, but robots.txt does not help because DNS discovery does not depend on search engine indexing (gbhackers.com).
  • Context: weeks after Muse launched, researcher Patrick Wardle reported a separate zero-day that let another local app take over a Muse account. Meta downplayed it because exploitation needs an already compromised device, though Wardle said a simple ClickFix attack was enough (wired.com).
  • Related prior cases: OpenAI removed ChatGPT's search discoverability feature in July 2025, and more than 370,000 Grok conversations were reported as indexed by search engines in August 2025 (gbhackers.com).

Remediation

  • Meta has paused Muse sharing, so this exposure is closed for now (wired.com).
  • Users should assume any previously shared Muse conversation may have been discovered, review what they shared, and avoid sharing sensitive content (wired.com, gbhackers.com).
  • Removing content does not erase hostname metadata already retained by passive DNS services (gbhackers.com).
  • Keep access tokens and titles out of hostnames and DNS, and do not rely on unguessable identifiers in URLs that resolve through DNS (gbhackers.com, wired.com).
  • For sensitive collaboration, use explicit recipient authorization instead of public links (gbhackers.com).

Linha do tempo

  1. wired.com ↗ · pub. 21/10/2026 09:35 · coletado 21/10 10:01

    Meta Muse share-link design flaw lets anyone enumerate users' private AI conversations via passive DNS

    ler a análise desta fonte

    Researchers at Claroc found that Meta's Muse AI assistant puts conversation titles in the subdomain of its share links, so anyone can discover them through passive DNS searches. Claroc enumerated about 6,800 shared-conversation links with a single query. After opening a few hundred, they found clearly private content, including confidential job-search notes, an internal revenue review, a loan application, a bank fraud alert with a partial account number, a real-estate investor's financial report, and a staff vacation calendar. Claroc reported the issue through Meta's bug bounty program on October 8 and got no reply. Meta has since paused the sharing functionality while it reviews the report and considers changes to how links can be discovered.

    Technical Details

    • All Muse share links use the domain cf.metaaiusercontent.com. The conversation title is placed in the subdomain, followed by a random string, for example loan-application-draft-a4c9e2.cf.metaaiusercontent.com (simplified example from the article).
    • Once a recipient opens a link, the DNS resolution is recorded by passive DNS sensors and becomes searchable in commercial passive DNS databases.
    • Claroc calls the class of issue GhostShares: pages that open for people who were never given the link and can find it on their own. The root cause is putting the title in the subdomain rather than in the URL path.
    • Context: weeks after Muse launched, researcher Patrick Wardle reported a separate zero-day that let any other local app take over a Muse account. Meta downplayed it because exploitation requires an already compromised device, though Wardle said a simple ClickFix attack was enough to hijack an account.

    Remediation

    • Meta has paused the Muse share feature. Users no longer face this particular exposure, at least for now.
    • Users should assume any previously shared Muse conversation may have been discovered and avoid sharing sensitive content.
    • Meta should stop encoding titles or other identifying data in hostnames and should reconsider how share links can be discovered.
  2. gbhackers.com ↗ · pub. 21/10/2026 07:22 · coletado 21/10 08:00 primeiro registro

    GhostShares: Meta Muse AI shared chats discoverable via passive DNS, exposing 6,800+ hostnames; Meta suspends sharing

    ler a análise desta fonte

    Researchers at Claroc disclosed GhostShares, a privacy flaw in Meta's Muse AI assistant that let outsiders discover shared conversations through passive DNS records. Muse built share URLs under cf.metaaiusercontent.com with the conversation title and a random identifier embedded in the hostname, so any hostname recorded by a passive DNS provider could be turned back into a working share link. Claroc found more than 6,800 share hostnames after filtering wildcard DNS noise and inspected only a few hundred pages, some containing personal financial details and confidential business material. Claroc reported the issue through Meta's bug bounty on October 8, and Meta told Ars Technica on October 20 that it was suspending the feature. The researchers found no evidence of misuse.

    Technical Details

    • The issue concerns discoverability, not unauthorized access to private accounts. Muse intentionally published conversations when users chose to share them.
    • The access token (random identifier) and descriptive metadata (title) were placed in the hostname, so they entered DNS and passive DNS historical datasets when a browser resolved the name.
    • Researchers reconstructed links without guessing identifiers, brute forcing, or signing in to Muse. Sampled pages opened in ordinary and logged-out incognito sessions.
    • Sampled content included a home sale budget, a bank fraud reminder with a partial account number, a small business loan application, a CEO-restricted revenue review, property investment figures, employee vacation schedules, and confidential preparation for an executive search conversation with a frontier AI laboratory. Meeting details and named contacts could support targeted impersonation or social engineering.
    • Claroc also reported more than 75 saved Muse scans on urlscan.io.
    • Muse discouraged crawlers, but robots.txt did not help because DNS discovery does not depend on search engine indexing.
    • After the suspension, 40 previously accessible shares were rechecked on October 20 and none opened, but historical DNS records still retained the hostnames, including embedded titles.
    • Related prior cases: OpenAI removed ChatGPT's search discoverability feature in July 2025, and more than 370,000 Grok conversations were reported as indexed by search engines in August 2025.

    Remediation

    • Keep access tokens out of hostnames and DNS; do not rely on unguessable identifiers in URLs that resolve through DNS.
    • For sensitive collaboration, use explicit recipient authorization rather than public links.
    • Users should review and stop sharing sensitive Muse conversations. Removing content does not erase hostname metadata already retained by passive DNS services.