Meta Pauses Muse Sharing After Researchers Find Sensitive Agent Conversations Through DNS Records

Meta has paused Muse’s sharing feature following research into discoverable links to sensitive conversations. The incident raises a practical question for AI-agent users: who can open the page an assistant creates when it is asked to share work?

In an emailed statement published by The Verge on October 20, spokesperson Tracy Clayton said Meta had paused the functionality while reviewing the report and considering changes to link discovery. The statement establishes a suspension and review, rather than a completed redesign.

What researchers found

Claroc’s research identified more than 6,800 share hostnames through a commercial passive-DNS dataset. Researchers opened a few hundred pages without signing in; most were unremarkable, while a minority contained sensitive personal or business information. The hostname count is not a count of affected people or confidential documents.

The company said conversation titles and random identifiers appeared in hostnames, allowing recorded DNS lookups to reveal share addresses. DNS history exposed addresses and titles; the conversation content came from opening the corresponding pages.

Claroc reported the issue to Meta on October 8. Its October 20 update says 40 previously accessible shares no longer opened during a recheck, although their hostnames remained in DNS history. That sample supports a change in access, not a conclusion about every historical share. Claroc said it had no evidence of misuse.

The difference between sharing and restricting access

The design question is what a user authorises when asking an assistant to share a conversation. A request to send something to a colleague can express a narrow intended audience. A page that anyone holding its address can open has a broader access model.

For product teams, that difference should be visible before the action completes. A confirmation should identify the material being shared, the intended recipients and whether access requires authentication. A recipient name in a chat is not, by itself, evidence that the resulting page enforces recipient restrictions.

AgentsCalling’s coverage of Microsoft’s Guardian Agents and changing enterprise permissions examines controls around agents acting inside business systems. Sharing deserves its own review because it creates an additional destination for the information an agent has assembled.

What the pause leaves unresolved

The reported recheck gives users a reason to distinguish present access from historical exposure. Closing a page can stop future retrieval from that address. It cannot establish whether someone previously retained its contents.

The useful follow-up questions for Meta concern the scope of the suspension: whether all previously created shares are disabled, what users can review or revoke, and what access controls will apply if sharing returns. Those questions should be answered separately from any announcement that the feature is available again.

For an organisation assessing its own exposure, an inventory of employee-created shares would be more useful than treating every Muse user as an affected person. Review should focus on what was actually shared and the sensitivity of that material.

A practical test for agent sharing

A controlled evaluation could use a fictional procurement discussion and two test accounts. Ask the assistant to share a summary with one named colleague, then check the resulting page from an unrelated, signed-out browser. The test should establish whether access matches the stated audience.

Next, revoke the share and check the same address again. Review whether the page title, URL or preview reveals information that was meant to remain private. Use dummy content and accounts under the tester’s control throughout.

The acceptance criteria should be concrete: the intended recipient can access the approved material, an unintended visitor cannot, and revocation blocks further access. If a product intentionally offers public links, its confirmation should make that consequence clear before publication.

These are proposed evaluation steps, not results of an AgentsCalling test. They give buyers a way to assess sharing behaviour separately from the assistant’s ability to complete a task.

Prepared with AI-assisted research and drafting. AgentsCalling has not independently reproduced Claroc’s findings.