Meta Muse Shared-Conversation Links Expose Users' Private Data

Security researchers from the firm Claroc said they enumerated 6,800 share links created by users of Muse, Meta's new general-purpose AI agent, and found that opening a few hundred of them exposed personal and business information that was clearly not intended to be publicly available.

The researchers reported their findings on Monday. The disclosure lands roughly a month after Meta CEO Mark Zuckerberg said Muse was "built from the ground up for privacy and security." That claim now sits against a concrete counterexample: a URL-construction design decision that made shared conversation links easy to discover rather than hard to guess.

The stakes are straightforward. Muse is a general-purpose AI agent, a class of product that handles searches, conversations, images and similar content on the user's behalf. Agents of this kind routinely process exactly the material people consider most sensitive — business plans, personal queries, documents and images. If sharing that material can leak it to strangers, trust in the agent category takes a direct hit, and Meta's privacy positioning takes a specific one.

How did the links become discoverable?

Like many online services, Muse lets users share searches, conversations, images and similar content with other people. The mechanism follows an industry-standard pattern. A user clicks an option to create a unique URL, and anyone who loads that URL sees a page hosting the shared content.

The security of that model rests entirely on the unguessability of the URL. To keep potentially sensitive information from being accessible to unintended people, share URLs typically contain a long sequence of text — a long random identifier that cannot be feasibly predicted or enumerated by an outsider.

Muse appears to take the same precautions on its surface. But according to the researchers, a central design decision for how Muse constructs its URLs made the links easy to discover. In other words, the identifier scheme did not provide the entropy (the practical unpredictability of the string) that this sharing model requires to be safe.

The consequence: Claroc's researchers were able to enumerate links — systematically guess or generate valid share URLs — at scale. They counted 6,800 of them.

What did the researchers actually find?

Enumeration alone demonstrates a design flaw. What the researchers found after opening a few hundred of the links turns the flaw into a demonstrated privacy breach.

The exposed material included information that was, in the researchers' assessment, clearly not intended to be publicly available. Ars Technica, which first reported the findings, characterized the exposed content as users' personal and business secrets shared through Muse conversations.

The scale parameters are worth stating precisely:

• 6,800 Muse share links enumerated by Claroc's researchers.
• A few hundred of those links opened and inspected.
• Sensitive personal and business information found among the contents.

That gap between the number enumerated and the number inspected matters. The researchers did not need to open all 6,800 links to confirm the exposure. A sample of a few hundred was sufficient to establish that users' private content was reachable by anyone who could reproduce the enumeration.

Why does this matter for AI agents specifically?

Share-link vulnerabilities are an old and well-understood problem class in web services. Secret URLs have leaked sensitive documents, cloud storage buckets and recorded meetings for well over a decade. Muse's case is notable because of what the product is.

Muse is not a document host or a file-sharing utility. It is an AI agent that Meta positions as a general-purpose assistant, and conversations with such agents tend to accumulate exactly the kind of context — personal circumstances, business plans, images, queries people would not type into a public search engine — that users assume stays between them and the provider. A share feature that leaks those conversations to anyone who can enumerate a URL undermines that assumption at the layer where users least expect failure: a convenience feature built for controlled sharing with specific people.

The timing sharpens the story. Zuckerberg's statement that Muse was "built from the ground up for privacy and security" came last month. The Claroc findings arrive weeks later and concern not an exotic attack but the most mundane surface imaginable: a share button.

The findings also follow prior security scrutiny of Muse, as Ars Technica's coverage notes, including earlier reporting on a serious zero-day vulnerability in the assistant. Read together, the reports suggest the product's rapid rollout is outpacing the maturity of its security engineering — a pattern with direct regulatory relevance, since AI agents that handle personal data fall under data-protection regimes in multiple jurisdictions.

What happens next?

Neither the enumeration method's full technical detail nor Meta's response was included in the initial disclosure. What the source material establishes is the core finding and its provenance: Claroc researchers, reporting Monday, enumerated 6,800 Muse share links and confirmed real exposure of sensitive user content.

For Muse users, the practical lesson predates this specific bug. A share URL is a bearer credential — anyone holding it can read the content — and a URL scheme that outsiders can enumerate converts "anyone I give this link" into "anyone at all." Until Meta confirms a fix for the URL-construction design at issue, the exposure documented by Claroc defines the risk profile of every conversation Muse users have shared through a link.