Security

Meta Muse security: shared links exposed loan applications and revenue reviews

A Meta Muse security flaw let researchers find 6,800 shared chats, including small-business files. What happened and how to share AI work safely.

By AgentPlaybook Real Estate · Published Oct 22, 2026 · 4 min read

Key takeaways

Researchers at security firm Claroc found 6,800 Meta Muse share links with a single passive-DNS query, because each link put the conversation title in the web address.
In a few hundred of them they found a small-business owner's loan application, a company revenue review, a staff vacation calendar and more.
Meta told Ars Technica it has paused Muse sharing while it reviews the report.
The problem was the share-link design, not a break-in, so the lesson applies to any AI tool: a "share" link can be more public than it looks.
Before sharing AI output, remove names, numbers and account details, and prefer sending a file to a named person over a public link.

Meta Muse security is under the spotlight after researchers showed how easily shared Muse conversations could be found by strangers. On October 20, 2026, Ars Technica reported that security firm Claroc enumerated 6,800 links that Muse users had created to share conversations, and found confidential business material among them. In response to Ars, Meta said it had paused the sharing feature while it reviews the report (Ars Technica). The story reached more than 400 points on Hacker News.

If you or your staff use Muse, or any AI agent with a "share" button, here is what happened and what to change.

What the researchers found

Claroc said that after opening a few hundred of the 6,800 links, it found information clearly not meant to be public. Ars lists, among others (Ars Technica):

a small-business owner's loan application, including the amount requested;
a national marketing company's internal revenue review, marked for its CEO;
a real-estate investor's performance report with property addresses and exact return, income and mortgage figures;
a workplace's full-year staff vacation calendar, listing dozens of employees;
a to-do list containing a bank fraud alert with a partial account number.

"If you had asked us beforehand, we would have guessed that gathering these would take real effort," the researchers wrote. "It took one query."

This was not a hack of Meta's servers. It came down to how the links were built.

The title was in the web address

Muse share links all used the domain cf.metaaiusercontent.com, and each one put the conversation's name in the subdomain, followed by a long random string. Ars gives simplified examples such as "loan-application-draft-…" (Ars Technica).

Passive DNS records it

When someone opens a link, the lookup of that subdomain can be captured by passive DNS services, which keep searchable history of domain lookups. Because the title sat in the domain name rather than in the page path, a single search of those records surfaced the links. Claroc's summary: "We call these GhostShares: pages that open for people who were never handed the link, and that those people can find on their own."

Reported, then paused

Claroc co-founder and CTO Asaf Aprozper said he reported the issue through Meta's bug bounty program on October 8 and got no reply, Ars reported. Meta's statement to Ars said it had "paused this functionality while we review this report and consider changes to how these links can be discovered." With sharing paused, this particular risk is gone for now.

The wider question: how much should an agent see?

Muse is built to do a lot for you. Ars notes it fills out forms, books appointments and makes purchases, and needs access to most of a user's accounts to work as intended. At launch, Meta CEO Mark Zuckerberg called it "built from the ground up for privacy and security" (Ars Technica). Meta's Alexandr Wang told CNBC that Muse "never sees your actual passwords or payment details" (CNBC).

The share-link issue is a reminder that the risk isn't only what the agent does. It's also where its output ends up. Ars also recounts an earlier problem: three weeks after launch, macOS security researcher Patrick Wardle reported a zero-day flaw that let another app on the same device take over a Muse account. Meta played down its severity.

Microsoft's security team made a similar argument in an October 19 post: agents should get only the access a task needs (Microsoft Security).

What this means for small businesses

Small businesses are exactly the users who paste a loan application or a revenue sheet into an AI to get help. That's a good use of AI, as long as the output stays private. Steps to take now:

Audit what has been shared. Ask staff whether they have shared any Muse (or other AI) conversations by link, and delete links you no longer need once sharing controls return.
Name conversations blandly. Since titles can end up in places you don't expect, avoid names like "Q3 revenue review" or a client's name. "Draft 3" gives nothing away.
Strip details before you share. Replace names, account numbers, addresses and exact figures with placeholders when a colleague only needs the structure.
Send files, not public links. Export the result and send it to a named person through email or a shared drive with access limits.
Write an AI-use rule for your team. One page covering what may go into AI tools, what must never go in (government ID, card numbers, full bank details) and how output may be shared. The agent access-rules prompt in the box below is a good starting point.
Keep the agent's access narrow. Connect only the accounts a task needs and remove the rest.

Our free prompt grader can also check a prompt for missing guardrails before you reuse it with any agent.

Frequently asked questions

Is Meta Muse safe to use for business?

Meta says Muse is built for privacy and security, but researchers found shared conversations could be discovered by strangers, and Meta paused sharing in response. Use it for low-risk tasks, keep sensitive files out of shared chats and limit connected accounts.

What are GhostShares?

It's the name Claroc gave to Muse share pages that people who were never sent the link could still find, because the conversation title in the web address showed up in public DNS records.

Has Meta fixed the Muse share link problem?

Meta told Ars Technica on October 20, 2026 that it paused the sharing feature while it reviews the report and considers changes. We haven't seen an announcement of a permanent fix yet.

How do I share AI conversations safely?

Remove names, numbers and account details first, give the conversation a neutral title, and send an exported file to specific people instead of creating a public link.

Sources

How we report: every fact, number and quote above comes from the linked sources, which we read before publishing. Product details can change quickly during previews, so check the vendor page before you buy. Spotted an error? Tell us via the link on our home page.