A shared AI conversation can be public without being easy to find. Researchers examining Meta’s Muse argue that its sharing design failed to preserve that distinction. WIRED’s current report describes sensitive material exposed through discoverable links and says Meta paused sharing while reviewing the issue. The underlying research shows why a random-looking address should not automatically be treated as an access-control system.
Discovery and access were separate parts of the exposure
In its GhostShares research, Claroc says it identified more than 6,800 share hostnames through a passive-DNS dataset and opened a few hundred pages. It reports finding personal records and internal business documents among otherwise ordinary shared material. Its explanation centers on conversation titles appearing in hostnames, where historical DNS observations could make them discoverable. The researchers describe finding existing records rather than guessing secret identifiers.
The report also gives limits that matter. The researchers did not establish the total exposure across Muse, how long every page had been reachable or whether outsiders had previously accessed it. They say they have no evidence of misuse. Finding a sensitive page demonstrates an access problem; it does not, by itself, establish a subsequent fraud or a complete inventory of affected users.
This is also why the number of identified hostnames should not be casually converted into the number of people harmed. A hostname, a conversation, a person and an organization are different units. An assessment that preserves those differences is more useful than an inflated estimate of victims unsupported by the investigation.
DNS history can outlast the content it described
Spamhaus explains the underlying mechanism in its July 2026 passive-DNS guide. Passive DNS records historical associations between domain names and DNS records, together with timing information. It is used to investigate suspicious infrastructure and reconstruct changes that a current lookup may no longer show. The guide describes recording resolution events rather than the identity of the person making a request.
That distinction is important but does not make every hostname harmless. A dataset can omit the requester’s identity while preserving information placed in the name being resolved. In this case, the privacy question concerns the descriptive address itself. The broader implication is analytical: data minimization has to consider what a naming scheme reveals, not only which fields a database deliberately collects about its users.
Claroc’s October 20 update says 40 previously accessible shares no longer opened when rechecked, while the hostnames remained in passive-DNS history. That observation supports a narrower conclusion than either complete erasure or continued access to all the underlying content. A page becoming unavailable and a historical reference disappearing are different events, and a response can achieve one without proving the other.
A pause is a response, not a complete retrospective account
According to the Meta statement quoted by WIRED, the company suspended the feature while considering how links could be discovered. That is a concrete change to availability. It is not a published account of every historical access, nor a demonstration that all copies of previously shared material have been removed. Claims about the response should remain within what has actually been reported and checked.
For organizations assessing AI sharing, the operational question is what the sharing action authorizes. Does it create a publicly accessible object, restrict access to named recipients or merely produce an address that looks private? A review should make that distinction visible to the person deciding whether to share. Otherwise, an apparently convenient collaboration step can carry consequences the user has not understood.
The case does not show that every AI conversation was exposed or that every public link was unintended. It shows why publication, discoverability and authorization need separate treatment. Pausing the feature addresses the immediate reported behavior; explaining the earlier exposure requires a careful account of both reachable content and the metadata that can remain afterward.
