Meta has temporarily disabled the public link-sharing feature in its AI agent Muse after cybersecurity experts from Claroc discovered a massive leak of private user conversations. According to researchers, unauthorized individuals could find and read other people's chats that were never intended for public viewing. Gathering vulnerable links required no complex hacking attacks—a single basic query was enough to track down and collect 6,800 links to Muse chats created by users to share information.
Architectural Flaw: Chat Name in Subdomain
The root of the problem lies in the URL architecture that Meta's developers built into the Muse service. Unlike the standard approach where services generate links with a random, long string of characters that is virtually impossible to guess, in Muse's case, the chat name was directly embedded into the address's subdomain. Examples of such links look like home-sale-budget-9f21c8a3.cf.metaaiusercontent.com or q3-revenue-review-7b1e42f0.cf.metaaiuser. When a recipient opened such a link, the subdomain information was instantly recorded in public passive DNS (pDNS) databases, becoming accessible to anyone who knows how to query them. Researchers dubbed this phenomenon GhostShares—pages that open for people who were never sent the links.
What Exactly Leaked: From Bank Accounts to Vacation Calendars
During a spot-check of several hundred open pages, Claroc recorded a wide range of sensitive data. Among them were a candidate's HR notes while preparing for a confidential executive search call for an advanced AI lab, which listed the internal contact name and meeting time. An internal financial revenue report for a national marketing company with a note for the CEO was also publicly exposed. Of particular concern was banking data: a small business owner's loan application detailing a specific amount, as well as a task list with fraud alerts from the bank, including partial account numbers, amounts, and transaction times. Additionally, researchers found a realtor's internal report with two exact property addresses, yield, revenue, and mortgage payment data, as well as a company employee's complete vacation schedule detailing the absence dates of dozens of workers by last name.
Timeline: From Bug Bounty to Meta’s Response
Claroc experts reported the issue through the Bug Bounty program back on October 8, 2026, but received no response from Meta for a long time. Only after journalists contacted the company for comment did Meta announce a temporary freeze on the link-sharing feature. In an official statement, the tech giant's representatives emphasized: «We opened the bug bounty program for Muse so researchers could expose various scenarios and help us improve the product. Users can share specific Muse materials. However, we have paused the functionality while we study the report and consider changes on how these links can be discovered.» At the time of publication, creating new public links in Muse is completely blocked.
Second Incident in a Month and the Privacy Paradox
The current leak has become the second major security incident for the Muse application in a short period. Just three weeks earlier, a zero-day vulnerability was discovered in the AI app that allowed third-party programs to hijack control of a user account. The paradox of the situation is compounded by the fact that a month ago, Meta CEO Mark Zuckerberg publicly claimed that Muse was «built from the ground up with a focus on privacy and security.» Meanwhile, the assistant itself requires deep access to users' personal accounts to perform actions—such as filling out forms, making bookings, and processing payments, making the consequences of such leaks especially sensitive for end users.
