Meta Pauses Muse Sharing After Researchers Find Publicly Discoverable Private Chats

Meta has paused the sharing feature in its Muse AI assistant after researchers showed that conversations users meant to keep private could be discovered through web links and indexed-like infrastructure. The finding matters because Muse was marketed as a privacy-conscious, general-purpose agent that can access calendars, documents, accounts, and other sensitive services on behalf of users.

The issue, reported by security researchers at Claroc, stemmed from a link design that made shared Muse conversations easier to uncover than users would reasonably expect. According to the researchers, they were able to identify thousands of share links and open a sample of them, revealing confidential notes, financial records, internal business information, and other material that appeared intended for a very limited audience.

What happened with Muse’s share links?

Muse lets users share conversations, images, searches, and similar content through unique URLs. That is not unusual; many online products use share links to let people distribute content without exposing it to the entire internet. The problem, Claroc researchers said, was that Muse’s links were built in a way that made them surprisingly easy to uncover.

Rather than hiding everything in a random, hard-to-guess path, Muse placed the conversation title inside the web address itself. That meant the link’s subdomain could expose enough information for outsiders to search for it through public or commercial DNS tools. Once researchers understood the pattern, they say they were able to enumerate 6,800 Muse links created for sharing conversations.

After opening a few hundred of those links, the researchers found content that did not look public at all. The material they described included internal revenue notes, a loan application, a fraud alert with partial account data, a real-estate investment report with exact financial figures, and a full vacation calendar for an entire workplace.

“If you had asked us beforehand, we would have guessed that gathering these would take real effort,” the Claroc researchers wrote. “It took one query.”

Why the design created a privacy problem

The weakness was not that Muse used a share link. The weakness was how the link was structured and how easily it could be discovered after a recipient had clicked it.

Claroc said the domain used for shares, cf.metaaiusercontent.com, was enough to make the links searchable in passive DNS systems. These systems store historical records of domain lookups and related metadata collected from monitoring infrastructure. Because the conversation title also appeared in the subdomain, the researchers could search for patterns that looked like legitimate Muse shares and surface pages that had never been meant for open browsing.

In practical terms, the structure turned what should have been a private invite into something that could be found by someone who never received the URL directly.

How passive DNS made the links easier to find

Passive DNS databases are widely used in security research, threat intelligence, and incident response. They can reveal when a domain has resolved to an IP address, which nameservers it has used, and other historical DNS data. When a user opens a Muse share link, the domain resolution can leave traces in these systems, creating a searchable record.

That is what made the link discovery so dangerous here. The share mechanism assumed secrecy based on the difficulty of guessing the URL, but the URL itself embedded readable clues. The researchers say the title in the subdomain was the key factor that made public discovery possible.

What kinds of information were exposed?

The examples Claroc provided suggest the issue went beyond harmless chat logs or casual brainstorming. The shared pages included details that could be valuable to competitors, scammers, or anyone trying to identify a person or company’s financial situation.

• Notes prepared for a confidential executive-search conversation with a frontier AI lab
• An internal revenue review from a marketing company, labeled for the chief executive
• A small business loan application showing the requested amount
• A to-do list mentioning a bank fraud alert, along with partial account and transaction details
• A real-estate investor’s performance report with property addresses and financial metrics
• A workplace staff vacation calendar listing dozens of employees and their planned time off

Each example points to the same underlying concern: users may have assumed a Muse share link would remain limited to the people they explicitly chose to send it to. Instead, the researchers say, the links were easy enough to surface that outsiders could find them without needing direct access from the sender.

Why does this matter for a privacy-focused AI agent?

Muse is not just another chatbot that answers questions. Meta has positioned it as a general-purpose agent that can autonomously complete tasks such as filling out forms, booking appointments, making purchases, and creating documents. To do that effectively, it needs substantial access to a user’s accounts and data.

That level of access is exactly why privacy and security expectations are so high. If a product is designed to act on a user’s behalf across sensitive systems, then a flaw in how it shares information can have consequences far beyond a leaked conversation transcript.

Meta has also marketed Muse as being built with privacy and security from the ground up. That claim made the sharing issue more awkward, especially after the product quickly rose near the top of Apple’s App Store rankings and began attracting attention as one of Meta’s more ambitious AI releases.

How Muse’s broader security story adds context

This is not the first security concern linked to Muse. Roughly three weeks after launch, security researcher Patrick Wardle reported a separate zero-day flaw involving local app control on macOS. He said another app on the same device could take over a user’s Muse account. Meta responded by suggesting the problem required a compromised device, while Wardle argued that a simple ClickFix-style attack could be enough to hijack an account.

Taken together, the incidents suggest a familiar challenge for fast-moving AI products: the features that make them powerful can also widen the attack surface. An assistant that can act across a user’s digital life must be treated as a high-risk system, not just a consumer novelty.

What did Claroc say it reported to Meta?

Claroc cofounder and CTO Asaf Aprozper said the firm filed the issue through Meta’s bug bounty program on October 8. He also said he attempted to contact people at Meta through LinkedIn but did not receive a response either way.

Meta told Ars Technica that it had opened Muse’s bug bounty program so outside researchers could raise scenarios like this and help improve the product. The company said that users can share specific Muse artifacts and that the shared page is intended to be accessible to anyone with the link. Still, Meta said it had paused the feature while it reviewed the report and considered changes to how those links can be discovered.

Meta said it has suspended the sharing function while it examines the findings and evaluates possible design changes to reduce the risk that links can be discovered by unintended people.

How serious is this compared with ordinary link sharing?

This is more serious than a typical user accidentally sending a link to the wrong person because the problem appears to have been systemic. In a standard mistake, the recipient list is wrong. In this case, the research suggests the publishing mechanism itself made some private content discoverable beyond the intended audience.

That distinction matters because it affects scale. A single mistaken message can expose one conversation. A design flaw in a popular share system can expose many conversations from many users over time.

It also matters because AI assistants often ingest highly sensitive content by design. People may paste in business plans, account information, legal drafts, or personal data because they believe the system will act like a private workspace. When sharing then becomes unexpectedly searchable, that trust can be undermined.

Why the trust issue extends beyond Muse

Muse’s situation is part of a broader debate over how much confidence users should place in AI agents that touch emails, files, calendars, purchases, and other sensitive systems. The more autonomous the assistant, the more damaging any security or privacy lapse can become.

That makes the lesson here relevant to the whole category of consumer and enterprise AI agents. Product teams may assume a share link is safe if it is technically hard to guess. But if the link structure leaks metadata or can be indexed through public infrastructure, the security model may be weaker than it appears.

Researchers have repeatedly warned that AI tools need secure-by-design defaults, especially when they are promoted as trusted helpers rather than simple query engines.

Timeline of the Muse sharing issue

The key events unfolded over a short period after Muse’s launch. This timeline shows how quickly the privacy concern moved from discovery to suspension.

What happens next for Muse users?

For now, Meta says the sharing function is suspended. That means users should not face the same exposure path while the company reviews the design and decides whether to alter how links are created or discovered.

The longer-term question is whether the fix will simply hide the links better or whether Meta will rework the share architecture more substantially. A robust solution would need to ensure that link discovery is not possible through public or semi-public infrastructure, even if a recipient has already opened the content once.

Users who relied on Muse for sensitive work should also assume that any content shared through the feature may have been more visible than they expected. If they used Muse for business, financial, legal, or personal planning, the safest course is to review what was shared and treat any linked artifacts with caution until Meta publishes more details.

What this means for the AI industry

The Muse case is a reminder that privacy claims in AI products are only as strong as the implementation behind them. Marketers often describe new assistants as secure, helpful, and designed for trust. But if the mechanics of sharing, logging, or account access are flawed, those promises can collapse quickly under scrutiny.

As AI agents become more capable, the pressure on product teams will only grow. They will be asked to balance convenience against confidentiality, and automation against user control. That balance is difficult even for established tech companies with mature security programs.

Muse’s pause may be temporary, but the underlying issue is not. Every AI assistant that stores, shares, or acts on private data will face the same test: can it protect users not just from obvious mistakes, but from subtle design choices that make sensitive information easier to discover than anyone intended?