What happened
Meta's new AI agent, Muse, has a share button — and for a while that share button was handing out links strangers could find in bulk. Security researchers at the firm Claroc pulled together 6,800 share links that Muse users had created, opened a few hundred of them, and found loan applications, revenue reviews, interview notes and staff vacation calendars sitting in the open. Meta has now paused the sharing feature while it looks into the report.
If you've never used an AI agent, think of Muse as a chat assistant that can also go off and do tasks for you — search, draft, plan, remember things. Meta CEO Mark Zuckerberg described it last month as "built from the ground up for privacy and security." Keep that sentence in mind as you read the rest.
How sharing is supposed to work
Most apps handle sharing the same way. You hit "share," the app builds a unique web address (a URL — the thing you paste into a browser bar), and anyone holding that address can open the page. The safety comes from making the address unguessable: usually a long random string of letters and numbers, like a locker combination with 30 digits. You can't brute-force it, and you can't stumble onto it by accident.
Why Muse's links were easy to find
Muse took most of those precautions, but it made one design decision that undid the whole thing. Every Muse share link sits on the same domain: cf.metaaiusercontent.com. And the link also includes the name of the conversation, jammed in front of the random string. A simplified example from the researchers looks like this: home-sale-budget-9f21c8a3.cf.metaaiusercontent.com.
That combination becomes a problem because of something called passive DNS. Plain version: every time a device visits a website, it looks the site's address up in a global phone book (DNS). Some commercial services keep a searchable history of those lookups. So the moment a recipient clicked a Muse share link, the address got logged — and anyone with a subscription to one of those history services could list every Muse share link that had ever been opened.
"If you had asked us beforehand, we would have guessed that gathering these would take real effort," the Claroc researchers wrote. "It took one query."
What was actually exposed
The researchers opened a few hundred of the 6,800 links. Among the material that was clearly never meant to be public:
• a job candidate's notes preparing for a confidential call with a frontier AI lab, including the lab's internal contact and the meeting time
• a national marketing company's internal revenue review, marked for its CEO
• a small-business owner's loan application, with the amount requested
• a to-do list containing a bank fraud alert, with a partial account number and a transaction amount and time
• a real-estate investor's performance report, with two property addresses and exact return, income and mortgage figures
• a workplace's full-year staff vacation calendar, listing dozens of employees against the week each one would be away
Meta's answer: pause and review
Meta told Ars Technica it opened the Muse bug bounty program so researchers could raise scenarios like this, and that it has paused the shared-link functionality while it reviews the report and considers changes to how those links can be discovered. Claroc co-founder and CTO Asaf Aprozper said he reported the findings through the bug bounty program on October 8 and also tried reaching Meta staff on LinkedIn — and got no reply either way at the time.
What it means for you
Here's the uncomfortable part: almost nobody in those 6,800 links did anything reckless. They used a share button the way it was designed to be used. The lesson isn't "never touch AI" — it's that a share link is a public web page protected by a secret address, and secret addresses leak.
At home
Think about the last time you asked an assistant to help with a mortgage comparison, a medical bill or a fight with your landlord. That chat probably holds your address, your income, maybe an account number. If you shared it with a partner through a link, that page was live on the open internet. Nobody had to hack anything — they just had to look in the right phone book.
At work
The marketing company's revenue review is the scenario that should make managers sweat. People paste real numbers into AI chats to get a summary, a chart, a first draft. Then they share the thread with a colleague. The thread becomes a URL. The URL becomes findable. That's a confidentiality problem dressed up as a convenience feature.
For business owners and freelancers
A loan application with the requested amount spelled out is exactly what a competitor or a scammer would love to read. If you run a small business and use an assistant to draft funding applications, client proposals or pricing models, treat every share link as a public post until proven otherwise.
For students
Coursework chats tend to include names, grades, teacher feedback and sometimes health or family details buried in scholarship essays. Sharing a study thread with a classmate feels harmless — until the thread is indexed and a stranger can read who wrote what.
For creative work
Writers, designers and musicians use AI to brainstorm. Unreleased lyrics, campaign concepts, a client's brand direction — that's intellectual property sitting in a chat. A shareable link is not a private folder. If you wouldn't email it to a stranger, don't generate a link to it.
For your income
The real-estate investor's report is the clearest case: property addresses plus exact returns, income and mortgage figures. That's a target list. The same goes for anyone whose earnings show up in a conversation — freelancers quoting rates, sellers working out margins, employees discussing a raise. If you want a low-stakes place to test prompts before you put anything sensitive into a big assistant, start with the free AI tools at mykreatool.com.
How to try it right now
You can't create a fresh share link while Meta has the feature paused, but you can absolutely clean up after the ones you already made — and that's the part that matters.
1. Check your history first (free, two minutes). Open Muse and scroll your conversation list. Look for threads you deliberately shared, and for anything you'd hate to see printed on a billboard.
2. Assume the link is public. Meta hasn't published a list of affected links, and there's no way for an individual user to know whether their URL got swept into a DNS index. Treat every link you've ever handed out as readable by anyone.
3. Delete the sensitive content at the source. Open the shared conversation and edit or delete the specific message with the account number, the salary, the client name. If you can remove the whole thread, do that. The link may outlive the content, but empty beats exposed.
4. Kill the link if the option is there. Look for a "stop sharing" or trash icon next to the shared item in Muse's share settings. If you can't find one — likely, given the pause — contact Meta support and ask for the link to be revoked.
5. Set one rule going forward. Before you type a real number, a real name or a real address into any AI agent, ask yourself: would I be fine if this turned into a public web page? If the answer is no, swap in a placeholder ("my mortgage is about $X") and keep the exact figure in your own notes.
That last step is the actual habit. The share button will come back — Meta only says it's reviewing — and when it does, the risk comes back with it.
Upsides and what changes
It's worth saying plainly that this is a bug bounty program working roughly as intended. Meta opened a program to pay researchers for exactly this kind of report, Claroc found the problem, and the feature went dark before anyone published a how-to. Plenty of leaks in recent years were found by journalists after the fact instead.
The likely product change is the interesting bit. When a company says it's "considering changes to how these links can be discovered," that usually means dropping the readable conversation name, lengthening the random part, adding an expiry date, or requiring a login to view. Any one of those would have stopped this in its tracks.
For users, there's a quieter upside: the incident makes the question concrete. "Should I put this in an AI chat?" used to be abstract. Now you have six real examples of what "shared" can actually mean, which makes the answer pretty obvious.
Limitations
Be careful about what this story does and doesn't tell us. Claroc enumerated 6,800 links and opened a few hundred — so nobody knows how many of the rest contained genuinely sensitive material, or how many people outside the researchers actually looked. Meta hasn't said how long the links were live, whether the readable conversation names will be removed, or when sharing comes back. Deleting a message doesn't necessarily invalidate a URL that's already been recorded somewhere, and passive DNS histories are sold by third parties, so "I deleted it" isn't the same as "it's gone." And pausing the feature stops new links — it doesn't recall old ones that were already indexed. If your business depends on sharing AI threads with clients, plan for a manual workaround (export and send) until Meta ships the fix.
Conclusion
Muse didn't get hacked. It handed out share links that were guessable by design — a readable conversation name sitting on a shared domain — and a commercial DNS history service did the rest. One query, 6,800 links, and a few hundred pages of loan applications, revenue reviews and vacation calendars that were never meant to leave the building. Meta paused the feature and is reviewing it, which is the right move, but a pause fixes tomorrow, not yesterday.
Your one action for today: open Muse, find every conversation you've shared, and scrub the sensitive details out of it — then stick a note on your monitor that says "no real numbers in the chat." It takes ten minutes, and it's the only part of this story you actually control.
Comments 0