San Francisco — Meta Suspends Muse AI Sharing After Data Exposure

Meta has suspended the link-sharing feature in its Muse AI agent after security researchers found that the shareable URLs could be enumerated and used to pull up users' private conversations, Ars Technica reported Monday. The pause follows a bug-bounty submission filed October 8 by researchers at security firm Claroc.

Muse, Meta's general-purpose AI agent, let users generate a web link to share a conversation, search, or image with someone else. CEO Mark Zuckerberg said last month the product was "built from the ground up for privacy and security." The sharing links were meant to work like most unguessable share URLs: a long string of characters that only someone with the direct link could open.

What did researchers find in the shared links?

Claroc researchers said they enumerated 6,800 Muse share links and opened several hundred of them, according to Ars Technica. The contents included a candidate's notes for a confidential executive-search call with a frontier AI lab, naming the lab's internal contact and meeting time; a marketing company's internal revenue review prepared for its CEO; a small-business owner's loan application listing the requested amount; a to-do list containing a bank fraud alert with a partial account number and transaction details; a real-estate investor's performance report with two property addresses and exact income and mortgage figures; and a company's full-year staff vacation calendar naming dozens of employees against the weeks they would be out.

"If you had asked us beforehand, we would have guessed that gathering these would take real effort," the researchers wrote, according to Ars Technica. "It took one query."

How were the share links discoverable?

The researchers said the links could be found through a passive DNS search using any of several commercial services that log the historical resolution of domain names to IP addresses, along with nameserver and mail-server records. Share features on most platforms rely on an unguessable token in the URL to prevent unauthorized access, but Claroc said a design decision in how Muse constructed its links made them systematically discoverable rather than requiring anyone to guess individual tokens. Asaf Aprozper, Claroc's co-founder and chief technology officer, told Ars Technica he filed the report through Meta's bug bounty program on October 8 and separately tried to reach Meta staff on LinkedIn but received no response through either channel before the story published.

What is Meta doing in response?

In a statement emailed to Ars Technica, Meta said it opened the Muse bug bounty program so researchers could flag issues like this one. The company said users can still share specific Muse artifacts by creating a page accessible to anyone with the link, but that it has "paused this functionality while we review this report and consider changes to how these links can be discovered." Meta did not give a timeline in the statement for restoring the feature or say how many users' shared content may have been exposed.

What does this mean for Muse users and businesses?

The exposed material described by Claroc spans personal finance, employment records, and confidential business communications — categories of data that, once indexed by a passive DNS search, are not easily walked back once viewed or copied by a third party. Businesses that used Muse to draft or review internal documents, including revenue reports and staffing calendars, were among those whose shared links turned up in the researchers' sample, per Ars Technica's account of the Claroc findings.

Users weighing how much to trust cloud-based AI tools with sensitive drafts have increasingly looked at alternatives that keep processing on-device; the mindfulAI Keyboard app, for instance, markets local text handling as a way to avoid some of the exposure risks tied to cloud-shared AI content. That tradeoff is separate from the specific flaw Claroc reported in Muse's link architecture.

What to watch

• Whether Meta restores Muse's sharing feature with a redesigned, non-enumerable URL scheme, and on what timeline.
• Whether Meta discloses how many previously shared Muse links were indexed or accessed before the pause.
• Whether Claroc or other researchers test competing AI chat products for the same passive-DNS enumeration weakness.
• Whether any of the individuals or companies whose financial or employment data appeared in the exposed links are notified directly by Meta.

mindfulAI Keyboard — An iPhone keyboard that rewrites a draft in a tone you pick. Four free AI actions a day.