Meta suspends Muse conversation-sharing feature after researchers find it exposed sensitive data

Meta has suspended the conversation-sharing feature in its Muse AI agent after security researchers reported that share links exposed sensitive personal and business information. The feature allowed users to generate unique URLs to share conversations, searches, images, and other artifacts with others. Meta promoted Muse as being “built from the ground up for privacy and security,” but researchers from security firm Claroc found that the design of the share links made them easy to discover.

Claroc reported that by performing a passive DNS search—using commercial services that store historical domain-to-IP mappings—they were able to enumerate 6,800 Muse share links created by users. After opening a few hundred of the links, the researchers found information that was clearly not intended to be public, including a candidate’s notes for a confidential executive-search call with a frontier AI lab, a national marketing company’s internal revenue review marked for its CEO, a small-business owner’s loan application with the requested amount, a to-do list with a bank fraud alert including a partial account number and transaction details, a real-estate investor’s internal performance report with property addresses and financial figures, and a workplace’s full-year staff vacation calendar listing dozens of employees.

Meta responded to questions from Ars Technica by stating that it opened its Muse bug bounty program to allow researchers to report scenarios and help improve the product. The company noted that people have the ability to share specific Muse artifacts via a page accessible to those with the link, but added that it has paused this functionality while it reviews the report and considers changes to how these links can be discovered.

Asaf Aprozper, co-founder and CTO of Claroc, said he reported the findings through Meta’s bug bounty program on October 8, 2026, and also attempted to contact Meta representatives via LinkedIn without receiving a response. The researchers attributed the ease of discovery to the design decision to include the conversation name in the URL subdomain—for example, home-sale-budget-9f21c8a3.cf.metaaiusercontent.com—along with a long string of text. This structure allowed the links to be indexed in passive DNS records, which the researchers described as “GhostShares”: pages that open for people who were never handed the link and that can be found without it.