Meta2026-10-21 09:43:33Meta’s Muse chat-sharing links exposed in DNS records, with more than 6,800 URLs foundMeta’s personal AI agent Muse has been hit by a privacy flaw that allowed chat-sharing links to be discovered in bulk, according to U.S. cybersecurity firm Claroc. The researchers said a single query of a DNS history database returned more than 6,800 share links tied to Muse conversations. After reviewing several hundred entries, Claroc said it found dozens of sensitive documents, including internal corporate revenue reports, small-business loan applications, and preparation materials for a candidate’s confidential recruiting discussions with a frontier AI lab, complete with internal contacts and meeting times. Claroc said the issue stemmed from Muse’s sharing design. When a user shared a chat, the system generated a public page that did not require login and embedded the chat title and a random ID in the domain. Once opened, the full domain could be logged by third-party DNS services. Claroc reported the issue to Meta on Oct. 8 and published its research on Oct. 18. Meta confirmed it had paused the chat-sharing feature on Oct. 20 after Ars Technica asked about the matter. A same-day recheck found 40 previously accessible links had stopped working, though chat titles remained visible in DNS history records.60
Meta2026-10-20 12:48:35Meta’s Muse AI agent exposed by enumerable share links, report saysMeta’s general-purpose AI agent Muse, launched last month, has been found to have a security flaw that may expose user conversations shared through web links. According to researchers at security firm Claroc, the links could be enumerated, allowing outside parties to access content that users likely did not intend to make broadly available. The researchers said they identified 6,800 share links created by Muse users and, after opening hundreds of them, found a large amount of sensitive material, including personal information and business secrets. The disclosure stands in contrast to comments made last month by Meta CEO Mark Zuckerberg, who said Muse was 「built for privacy and security from the ground up」. Ars Technica was cited as the source of the report in the Techub News item.60
