Muse AI leaks user secrets in shared chats
Archived — this story has rotated out of today’s deck. It is kept here in full.
The gist
Meta shut off Muse's chat-sharing feature after researchers found 6,800 share links listed in public DNS.
The links carried conversation titles, exposing personal and business details to anyone searching.
Background
Muse is Meta's general-purpose AI agent, which autonomously fills out forms, books appointments, makes purchases and creates documents, and needs access to most of a user's accounts; it quickly rose to a top spot in Apple's App Store. Security firm Claroc found that Muse names each shared chat's web address after the conversation's own title, and that address is written into public DNS (the internet's public directory of domain names), so a single search returns thousands of them listed by name. The findings follow earlier Muse security revelations, including a zero-day vulnerability found by macOS security expert Patrick Wardle and Muse keeping files on users' friends and families.
How it unfolded
- Oct 8, 2026Claroc reported the flaw to Meta's bug bounty program.
- Oct 18, 2026Claroc published its findings.
- Oct 20, 2026Ars Technica reported that Claroc researchers enumerated 6,800 Muse share links and, after opening a few hundred, found sensitive personal and business information.
- Oct 20, 2026Meta told Ars Technica it had shut off or suspended the Muse conversation-sharing feature after the outlet asked about the findings.
- Oct 21, 2026The Ars Technica story was discussed on Hacker News.
Who’s saying what
- Analysts
- Claroc co-founder and CTO Asaf Aprozper said the company contacted Meta and never received a reply, and concluded after checking similar platforms and Muse documentation that the behavior is by design.
- Official
- Meta told Ars Technica it suspended and then shut off the sharing feature after the outlet asked about the findings, and a representative did not immediately have answers to emailed questions.
- Support
- Aprozper said Claroc was glad to see the feature closed this quickly and had no evidence anyone had misused the shares.
Still unverified
The findings do not establish that every shared conversation was exposed or that all 6,800 links contained sensitive information; researchers inspected only a sample, so the full contents of the links found are unknown. The report also does not establish that all conversations were publicly searchable.