Meta suspended the conversation-sharing feature in MUSE, its general-purpose AI agent, after security firm Claroc enumerated more than 6,800 share links through public DNS records and found sensitive personal and business information exposed on the open web1,2,3.
MUSE lets users create a unique URL to share searches, conversations, images, and other content with others. The URLs are designed to contain a long, hard-to-guess text string to prevent unintended access. But a central design decision in how Meta constructed those URLs made the links easy to discover, Claroc researchers reported on October 20, 2026.
What the links contained
After opening several hundred of the 6,800 links, Claroc found information that was clearly not intended to be public. The exposed material included a national marketing company's internal revenue review marked for its CEO, a real-estate investor's performance report with property addresses and exact return, income, and mortgage figures, a small-business owner's loan application with the amount requested, and a workplace's full-year staff vacation calendar listing dozens of employees. One link contained a to-do list with a bank fraud alert, a partial account number, and a transaction amount and time. Another held a candidate's notes preparing for a confidential executive-search call with a frontier AI lab, naming the lab's internal contact and meeting time.
Meta's response
MUSE spokesperson Tracy Clayton said in a statement to The Verge that people have the ability to share specific MUSE artifacts, which creates a page accessible to those with the link, but that Meta has "paused this functionality while we review this report and consider changes to how these links can be discovered". Meta also said it opened the MUSE bug bounty program so researchers could raise different scenarios and help improve the product.
The disclosure is notable given that Meta CEO Mark Zuckerberg said last month that MUSE was "built from the ground up for privacy and security".
ANALYSIS The incident underscores a recurring design tension in AI-agent products: share-link architectures that work for static content can become liabilities when users feed agents sensitive, unstructured data such as financial records and personnel schedules. Meta's decision to suspend the feature rather than patch the URL scheme suggests the fix may require more than a surface-level change.