Meta Pauses Muse Chat Sharing After Researchers Say Shared Chats Could Be Found Through DNS Records

Meta has paused conversation sharing in Muse, its personal AI agent, after Ars Technica asked about research showing that strangers could find shared chats [1]. The security firm Claroc says a single search of passive-DNS records, databases that log the web addresses devices look up, returned more than 6,800 Muse share addresses [2].

Meta has not published a statement of its own. Its only comment came by email, to Ars Technica and to The Verge [1] [3].

How it unfolded

• Sep 8, 2026. Meta launches Muse, calling it "a secure, private personal AI agent" [4]. Meta says it can "open a browser, fill out forms, and negotiate on their behalf" [4].
• Sep 21. Ars Technica reports a zero-day, a flaw unknown to the maker, found by Patrick Wardle. It let local apps take over a Muse account, and Meta later said it shipped a hotfix [5].
• Oct 8. Claroc reports the problem to Meta's bug bounty program "with reproduction steps and example shares" [2]. Asaf Aprozper, Claroc's co-founder and CTO, told Ars he got no reply through the program or on LinkedIn [1].
• Oct 18. Claroc publishes its write-up and names the issue "GhostShares": pages "that open for people who were never handed the link" [2]. "If you had asked us beforehand, we would have guessed that gathering these would take real effort. It took one query," the team writes [2].
• Oct 20. Ars Technica's Dan Goodin reports the findings. In response to Ars's questions, Meta says it is pausing sharing [1]. Muse spokesperson Tracy Clayton sends The Verge the same statement [3]. Claroc updates its post: 40 shares it rechecked no longer opened [2].

What went wrong. Muse built each share's web address from the conversation's title plus a random ID [2]. Opening a share makes the browser look up that address, and DNS logs the whole name, "random ID and all" [2]. The part meant to be unguessable got recorded with everything else.

Every share used the domain cf.metaaiusercontent.com [1]. Ars traces the problem to "putting the conversation title in the subdomain rather than in the URL path" [1].

Blocking search engines did not help. Muse's robots.txt file keeps search crawlers out, but "robots.txt governs crawling, not access," Claroc notes [2]. The public scanning service urlscan.io also held more than 75 saved scans of share pages, Claroc says [2].

What was exposed. Claroc opened only a few hundred pages and says most were "unremarkable," such as small-business sites and event calendars [2]. A minority were sensitive. Opened with no login, they included a home-sale budget, a small-business loan application, a revenue review meant only for a CEO and a job candidate's confidential notes for a call with an AI lab [2] [3]. Claroc says it has no evidence anyone misused the shares [2].

Weighing the claims. Claroc sells a browser extension that flags public AI share links, so it has a commercial interest in the finding [2]. We found no independent report reproducing its 6,800 count, and Claroc says its study "is not a measure of Muse's total exposure" [2]. Meta's statement treats the pages as working as built: a share "creates a page that can be accessed by those with the link" [1].

The pattern is familiar. In 2025, OpenAI removed an option that let shared ChatGPT chats be indexed by search engines [6], and more than 370,000 shared Grok chats turned up in search results [7]. Muse is widely used, with 10.9 million downloads since its September debut, per Sensor Tower data reported by TechCrunch [8].

What's next. Meta told Ars it will "review this report and consider changes to how these links can be discovered" [1]. It gave no timeline. The pause does not erase the record: the hostnames, "titles included, are still in passive-DNS history," Claroc reports [2].

OpenAI's GPT-6-Astra, a general-purpose AI model, scored 81.9% on the RoboDojo robot benchmark, but only with up to 10 times the usual step budget, a SenseNova-led team reports [9]. At the standard budget it scored 27.6% [9]. The authors are upfront about the catch: the best results come only when the model studies demonstrations first and gets many more moves than usual [9].

The report was posted to arXiv on Oct 15 and revised Oct 19. It is a preprint, not yet peer-reviewed [9]. The team's verdict is that Astra "has largely crossed the threshold of embodied competence, but not yet that of practical embodied intelligence" [9]. "Embodied" here means controlling a physical body, such as a robot arm.

This is a test of an existing model, not a new one. OpenAI is not an author, and it pitched Astra in September for computer use, coding, cybersecurity and science, not robotics [10].

How the test worked. The team ran Astra on 12 benchmarks covering tabletop arms, humanoids, mobile robots and dexterous hands [9]. Two allowances shaped the results. First, in-context learning: Astra reads each benchmark's training demonstrations and writes a frozen "knowledge package" of notes and reusable code, while its weights, the model's learned settings, stay unchanged [9]. Second, an extended budget that "allows ten times as many action steps as the standard budget" [9].

Why the gap. The authors concede that Astra's benchmark results "depend heavily on conditions that the benchmarks grant" [9]. Simulators pause while the model thinks. On RoboDojo, the standard budgets equal 8 to 76 seconds of robot motion, against an average of 55 minutes of computing [9]. Under the extended budget, one RoboDojo episode averages more than three hours [9].

The team also built a prototype household test where the clock keeps running. Astra took 8 seconds of world time to decide to turn off a burner, and the egg charred [9]. It also left a refrigerator door open from 300 to 765 seconds [9].

Real hardware shows similar limits. On the Unitree G1 humanoid, Astra spent about 90% of each run deliberating, and one manipulation trial took over an hour [9]. On one robot hand it completed 0 of 3 grasps without human-written grasp routines and 3 of 3 with them [9].

Cost. One LIBERO-Long++ episode used about a million tokens, the chunks of text a model processes, and nearly an hour [9]. The authors estimate roughly $1 per million tokens, since about 98% are cached input [9].

The independent leaderboard Artificial Analysis ranks Astra first on its AA-Robotics v0.1 test with a score of 69, at an average of 30 minutes and $16.36 per task [13]. It finds today's models "roughly 100 times slower than a human" [13].

Safety. One outside warning comes from Zhang et al., another preprint not yet peer-reviewed: "Testing was halted after the model repeatedly issued physically unreasonable or unsafe actions, including incidents that damaged hardware; no person was injured" [11]. Robocurve's RoboHarm test reports that Astra refused 2 of 100 harmful robot-arm instructions on safety grounds (3 of 100 counting refusals for any reason) [14]. The robotics company Pantograph saw runs end with the model "confidently claiming that the towel is in the hamper, when it is clearly visible on the floor" [15].

Sphinx is a free, MIT-licensed Git hook, a script Git runs automatically before an action such as a push, and it asks you a question about what your AI agent's code does before it ships [16]. Its npm package was first published Oct 16 and is at version 0.1.11 [17]. The Show HN post on Oct 18 drew 252 points and 89 comments [18].

How does it work? When you push to a protected branch, Git waits while Sphinx asks you to predict what your change will do [19]. Miss something and it explains, then offers a new scenario. Pass and the push continues [19].

A separate reviewer model writes the questions. It reads the change with read-only Git tools and never sees the conversation that produced the code [19]. Questions cover "behavior, failure modes, and invariants rather than file names or function names," and the check is open-book [19].

What does it need? It works with Claude Code, Codex, Cursor, OpenCode, Pi or plain Git, and "your answers never reach the coding agent" [16]. The reviewer runs on your own Claude Code or Codex plan, OpenRouter or any OpenAI-compatible endpoint [19]. A typical check makes about 5 to 8 model requests, with no default cap [19].

Can't people just cheat? Yes, and the authors say so: "This is practice, not a security gate. Anyone with local access, including a coding agent, can bypass hooks or get outside help" [19]. On Hacker News, one commenter wrote, "Nothing prevents a lazy person from copy-pasting the question to the agent" [18].

Does passing mean the code is right? No. A commenter separated "understanding what a PR does versus knowing how to tell if it's wrong" [18]. The authors' own tests used "five small, synthetic Git repositories" and were "not an all-green semantic evaluation" [20]. In one case the grader rejected a correct answer, and a second model, Sonnet 5.5, "reproduced the material false negative" [20]. Your changed code also goes to the reviewer provider, and version 0.1 checks only local commits and pushes [19].

Is it new? Not entirely. Commenters pointed to similar tools, including PEAK, built about six months earlier [18]. One liked that it "tests whether the person understands the change instead of adding another AI reviewer" [18].

The landing page jokingly credits its epigraph to "Sun Tzu." The line, "you can outsource your thinking / but you cannot outsource your understanding," comes from an X post by @yacineMTB [21].