Researchers found 6,800 shared Muse chats with one search because the chat title sits in the link. Meta has paused sharing, but anyone who shared should check.
Meta's new AI assistant, Muse, let people share chats by link. A security firm says those links were easy for strangers to find. Researchers at Claroc gathered 6,800 of them with a single search. Meta has now paused the sharing feature while it looks into the report.
A share link is a web address that opens a saved chat for anyone who has it. Normally the address includes a long random string, so nobody can guess it. Muse did that too. But it also put the chat title at the front of the address, such as a title about a home sale budget or a loan application draft.
Every Muse link also ends in the same domain name, cf.metaaiusercontent.com. Public databases called passive DNS records log web addresses once they are used. Anyone can search them. Claroc searched for the shared domain and the chat titles came up in the results.
After opening a few hundred of the links, the researchers found information that was clearly not meant to be public. "It took one query," they wrote.
Muse is built to act for you. It fills out forms, books appointments, makes purchases and creates documents, and it needs access to most of a user's accounts to do that. People may paste in the kind of details they would never post online. A chat title alone can give away a lot, and the full chat opens for anyone who finds the link.
Meta's CEO, Mark Zuckerberg, said last month that Muse was "built from the ground up for privacy and security." This is also not the first concern. Three weeks after launch, security expert Patrick Wardle found a flaw that let another app on the same device take over a user's Muse account. Meta played down that finding.
People who never shared a Muse chat by link are not affected by this particular problem. The risk falls on anyone who did share one. That includes small businesses, clinics and agencies where staff may have pasted client or financial details into a chat and sent the link to a colleague or customer.
The steps in the alert box above cover what to check and what to set up. The short version: find out who has shared chats, and decide on rules before the feature returns.
Meta says it paused sharing while it reviews the report and considers changes to how these links can be discovered. Claroc says it reported the issue through Meta's bug bounty program on October 8 and also tried LinkedIn, but heard nothing back. Claroc concluded the behavior is by design.
Several things are still unknown. The material does not say whether links already created still work, or whether Meta will change the link format. Nor does it say when sharing will return. Users are safe from this threat only "at least for now," so watch for Meta's announcement.
If anyone on your team shared a Muse chat by link, delete the link and keep client, health and financial details out of AI chats.
A leak shows how Apple may tighten Full Disk Access on Macs, the setting that lets an app read nearly everything, as AI agent apps ask for it more often.
Read more: Apple plans to make it harder for AI apps to see all your Mac filesOpenAI plans to buy Pierre Computer Company, whose code review tools already run inside Codex, a sign that AI coding is shifting toward checking code, not just writing it.
Read more: OpenAI Is Buying a Small Company That Helps Teams Review CodeGoogle's Gemini chatbot can now open and edit some files in the chat, PDFs included. A reviewer found it handy for quick fixes but not a replacement for Docs or Acrobat.
Read more: Gemini can now edit your PDFs and Google files inside the chat
