IA · 20 October 2026 · 5 min read
A Shared Link Was All It Took: Meta Pauses Muse Sharing Following Mass Data Exposure
In brief: Meta has abruptly paused the conversation sharing feature on its flagship AI agent, Meta Muse, after security researchers revealed how easily private user chats could be enumerated. Because of how the sharing infrastructure exposed network records, over 6,800 public conversation links containing corporate balance sheets, confidential recruitment notes, and bank alert details were uncovered using a single passive DNS query.
by Team Mocchi's
Billed by CEO Mark Zuckerberg just last month as a next-generation assistant «built from the ground up for privacy and security», Meta Muse is already facing its first major security stumble. In recent hours, Menlo Park had to abruptly suspend the web sharing feature of its new flagship AI agent after researchers demonstrated that anyone equipped with rudimentary network tools could inspect thousands of confidential user conversations.
The disclosure came following technical findings by cybersecurity firm Claroc, as first reported by Ars Technica. What was designed as a frictionless collaboration utility—allowing users to generate a quick link to show answers and charts to colleagues or clients—effectively turned into an open directory of sensitive data, bypassing any form of authentication.
One single query, thousands of leaked sessions
The vulnerability did not require complex cryptanalysis or brute-force attacks. Instead, it stemmed from an architectural choice in how sharing URLs and network endpoints were configured. In modern web services, shared sessions typically rely on long, non-indexable random identifiers tucked into URL paths on the main domain. With Muse, however, the sharing infrastructure left visible traces in passive DNS databases, the historical records routinely indexed by security analysts to map domains and hostnames over time.
By querying a standard commercial passive DNS service, Claroc's research team discovered 6,800 user-created sharing URLs with a single search. There was no protective perimeter, no rate-limiting barrier, and no automatic alert triggered on Meta's infrastructure: the list of active links was completely exposed to anyone looking in the right place.
From corporate balance sheets to bank records: what leaked
Claroc examined a sample of several hundred open links and uncovered a troubling catalog of confidential corporate and personal data that employees had casually fed into the model. Exposed materials included interview preparation notes for an executive-search call at a leading frontier AI lab detailing internal contacts and scheduling, a national marketing agency's confidential revenue review marked for its CEO, and an entrepreneur's small-business bank loan application including the exact amount requested.
Other exposed sessions contained personal to-do lists featuring active bank fraud alerts with partial account numbers and timestamps, a real-estate investor's private portfolio report listing street addresses and mortgage details, and an entire company's annual staff vacation schedule mapping out employee absences across the calendar year. On dark web marketplaces or in corporate espionage campaigns, such records serve as high-grade ammunition for targeted spear-phishing and social engineering attacks.
Menlo Park suspends the feature after weeks of silence
The episode also underscores recurring frictions between external bug bounty programs and enterprise response times. Asaf Aprozper, co-founder and CTO at Claroc, reported the issue through Meta’s official bug bounty channel on October 8 and even reached out to several company employees via LinkedIn, receiving no reply through either route.
Action only came after press inquiries were submitted to the social media giant. Meta confirmed it had taken the tool offline. «We opened the Muse bug bounty program so researchers could raise different scenarios and help us continue improving the product», a company spokesperson said, adding that the feature has been paused while engineering teams evaluate structural updates to ensure shared links cannot be systematically harvested or discovered.
Mocchi's take
This incident is a stark reminder that the real-world attack surface of modern AI platforms rarely lives inside the transformer model itself, but in the surrounding, legacy software plumbing. For companies building with or rolling out AI agents, the common employee reflex to click «share link» to circulate a generated table, budget, or strategy memo represents an unmanaged shadow IT nightmare. Corporate security governance must move beyond prompt guidelines and enforce strict restrictions on unauthenticated link-sharing that bypass enterprise single sign-on. When building custom AI workflows, every output channel must be treated as potentially public unless cryptographically gated from day one.