Muse, Meta's new general-purpose AI agent, just learned an old internet lesson the hard way: a share button is only as private as the link it hands out. Researchers at the security firm Claroc reported Monday that they'd pulled 6,800 Muse share links out of a single search — links that real people had made to pass a conversation to a colleague, a client or a friend. Meta's response was blunt and fast: the feature is now switched off.
What happened
Muse works like other AI assistants. You type, it answers, and you can save or share what came out. Sharing happens through a link — think of it as handing someone the key to a storage unit. Anyone holding that key can open the door and see what's inside, which is fine as long as only the right person gets a copy.
Mark Zuckerberg said last month that Muse was 'built from the ground up for privacy and security.' The sharing setup looked like it followed that script. It didn't, quite.
The locks were fine. The addresses weren't.
A normal share link ends in a long, scrambled string of characters — meaningless to a human, close to impossible for a computer to guess. Muse did use those scrambled strings. But two design choices undid the protection.
First, every Muse share page sat on the same web address: cf.metaaiusercontent.com. Second, the conversation's own title got baked into the link. So a link might read something like `home-sale-budget-9f21c8a3.cf.metaaiusercontent.com`. That's not a lock. That's a lock with the contents written on the outside of the box in permanent marker.
One query, 6,800 links
Here's where plain-English tech comes in. When anyone clicks a link, their device has to look up where that address lives — the same way your phone log records that you called a number. Those lookups get stored by monitoring systems and sold as 'passive DNS' records. Passive DNS is basically a public phone book of who looked up what, kept over time.
The Claroc team didn't hack anything. They queried one commercial passive DNS service for one domain — cf.metaaiusercontent.com — and got back 6,800 share links that Muse users had created. As the researchers put it: 'If you had asked us beforehand, we would have guessed that gathering these would take real effort. It took one query.'
What was actually inside
Claroc opened a few hundred of those links. What they found wasn't cute poetry drafts:
• A job candidate's prep notes for a confidential call with a frontier AI lab, including the lab's internal contact and the meeting time.
• A national marketing company's internal revenue review, marked for the CEO.
• A small-business owner's loan application, amount included.
• A to-do list with a bank fraud alert on it — partial account number, transaction amount and time.
• A real-estate investor's performance report with two property addresses and exact return, income and mortgage figures.
• A workplace's full-year vacation calendar, listing dozens of staff against the week each one would be away.
Meta's reply
After questions from reporters, Meta said it had paused sharing while it reviews the report: 'We opened the Muse bug bounty program so researchers could raise different scenarios and help us continue improving the product... we've paused this functionality while we review this report and consider changes to how these links can be discovered.'
Claroc cofounder and CTO Asaf Aprozper said he filed the finding through that bug bounty program on October 8 and also tried reaching Meta staff on LinkedIn. No reply came either way.
What it means for you
The takeaway isn't 'don't use AI.' It's that anything you can share with a link can be shared with the internet, and the difference is often one careless design decision.
At home
Most people paste personal stuff into chats and forget about it — bills, screenshots of a bank alert, a list of medications. If that chat gets a share link, your to-do list is now a public web page. The fix is simple: treat anything with an account number, a dollar figure or an address as something you wouldn't put on a billboard.
At work
That vacation calendar is the scariest example for managers. It's harmless in isolation, and a gift to anyone planning a phishing campaign — they know exactly who's away and when. Same goes for a revenue review marked for the CEO. Any document you'd only hand to three people shouldn't travel by link if the link can be found.
Running a business
If you're a small-business owner, your loan application is essentially your financial diary. The amount requested, the numbers behind it, sometimes the bank's comments. Anyone who guesses the link before the loan closes has leverage you didn't agree to give them. The same is true of supplier pricing, payroll drafts and internal performance reports.
For students and researchers
Group chats, source lists, half-finished arguments with an AI about a thesis — these often carry names of real people, unpublished data or an adviser's private comments. Students share AI chats constantly because it's easier than emailing a document. That habit is what made this bug dangerous in the first place.
For creators
If you build in public, sharing an AI conversation with your audience is part of the job. The risk is that the same chat also contains your unreleased idea, your client's brief or your revenue figures. A share link doesn't know which part you meant to show.
How to try it right now
You can't test Muse sharing while Meta has it switched off. You can still check your own exposure this week. Free options first.
1. Search your history for links you already sent. Open your Muse chat history and your sent messages. Any share link you created is a candidate. Write down which conversations you shared and roughly when.
2. Treat every link you sent as public until proven otherwise. You won't get a warning that a stranger opened one. If a link touched a bank alert, a contract or someone else's personal data, act accordingly.
3. Use free AI tools for the cleanup thinking. A quick way to get unstuck is MyKreatool — free AI tools that'll help you draft a 'never paste this' checklist for your team, write a short redaction routine, or turn a messy notes file into something safe to share.
4. Redact before you paste. Strip account numbers, full addresses, employee names and client names. Replace them with placeholders like '[bank]' or '[client A]'. This takes thirty seconds and removes most of the damage.
5. Rotate what was exposed. If a card number or account number surfaced, call the bank. If a client's pricing leaked, tell them before they find out.
6. Watch for Meta's next update. The company says it's reviewing the report and considering changes to how these links can be found. That's the signal to check whether your old links stop resolving.
Upsides and what changes
This is a bug bounty program doing exactly what it's supposed to do. Claroc found a flaw, reported it through the official channel on October 8, and Meta paused the feature instead of arguing. That's the system working, even if it took public questions to move it.
The bigger shift is industry-wide. 'Long random string equals safe' has been the default assumption for a decade of share links, and it turns out the string only protects you if nobody can find the domain in the first place. Expect more products to stop putting human-readable titles in shareable web addresses. Expect security teams to start asking vendors a new question: can your share links be found with a passive DNS lookup?
For everyday users, the upside is a habit. Once you've seen a vacation calendar go public, you stop pasting your whole financial life into a chat window. That's a permanent improvement.
Limitations
Honest caveats, because this story has plenty. The 6,800 figure is what Claroc could see through one passive DNS source — it's not necessarily the total, and there's no public evidence that anyone with bad intentions opened these links before the researchers did. The share feature is paused, so nobody outside Meta can verify the fix or test whether the underlying design problem is solved. Passive DNS records persist, which means links may stay discoverable in historical logs even after Meta deletes them. And most of those 6,800 conversations were probably completely mundane — a recipe swap, a workout plan, a first draft. That's the thing about a design flaw, though: it doesn't sort your chats into 'sensitive' and 'safe' before it exposes them.
Conclusion
The Muse story is a reminder that 'private by design' is a claim you test, not a badge you print on a slide. Meta's share links weren't cracked by a genius hacker. They were listed in a public index, with the contents named in the address. Meta has paused the feature and says it's considering changes, which is the right response — late, but right.
One action for today: open whatever AI assistant you use most, find the last conversation you shared, and check whether it contains a number, a name or an address you wouldn't want in a stranger's browser history. Then start the habit of redacting before you share.
Comments 0