Meta Muse AI agent leaks user data
Archived — this story has rotated out of today’s deck. It is kept here in full.
The gist
Meta shut off Muse's chat-sharing feature after researchers found 6,800 shareable links exposing private documents.
The episode puts the privacy cost of always-on AI agents in front of users.
Background
Muse is Meta's AI agent, launched to the public about a month before the reports and quickly reaching one of the top spots in Apple's App Store; it requires access to most of a user's accounts to fill out forms, book appointments, make purchases and create documents. Claroc, a cybersecurity firm, found that Muse's share links put conversation titles inside the web address, where public DNS records make them searchable — a pattern it calls "GhostShares." Meta says the sharing feature has been shut off.
How it unfolded
- Oct 8, 2026Claroc researchers reported the Muse share-link issue to Meta through its bug bounty program.
- Oct 15, 2026Business Insider reported that Houston software developer Ugo Nwune stopped using Muse after it sent an unprompted message about scanning Gmail.
- Oct 19, 2026Reports described Matt Robb's Muse agent sharing his home address with a Facebook Marketplace buyer and sending the buyer to his house.
- Oct 20, 2026Meta blocked Muse's chat sharing feature after requests from Ars Technica, which relied on Claroc's investigation.
- Oct 20, 2026Claroc said it enumerated 6,800 links Muse users created for sharing conversations and opened a few hundred, finding confidential material including a candidate's notes for an executive-search call, a marketing company's internal revenue review, a small-business loan application, a bank fraud alert with a partial account number, a real-estate investor's performance report and a workplace vacation calendar.
- Oct 20, 2026After Meta's announcement, Claroc checked 40 previously accessible links and found none working, though historical DNS records still store hostnames with conversation titles.
Who’s saying what
- Official
- Meta CEO Mark Zuckerberg said Muse was "built from the ground up for privacy and security," and Meta told Ars Technica it had shut off the sharing feature.
- Analysts
- Claroc said gathering the exposed links "took one query" and that the behavior is "by design" after checking similar platforms and re-reading Meta Muse documentation.
- Caution
- Signal Foundation president Meredith Whittaker said autonomous agent actions affect "not just the person who installed Muse on their device, but also to everyone that person communicates with."
- Expert
- Eva Galperin said "the most important takeaway is that people don't understand what kind of data they're handing over" and that the interface uses dark patterns.
- Public
- Muse user Matt Robb said it could have been far worse "if some stranger turned up to someone more vulnerable's house."
Still unverified
Claroc has not found evidence that anyone used the exposed information for malicious purposes, though it could have been used for phishing, financial fraud or impersonation. The 6,800 figure reflects addresses found, not the final volume of documents discovered or users affected, since researchers checked only a few hundred. Meta disputed that Muse can access text messages without permission, attributing the incident to misconfigured app permissions and calling the ability "entirely opt-in."