Meta Muse privacy flaw exposed: one search found more than 6,800 chat links, and corporate secrets were also turned up

U.S. cybersecurity company Claroc found that chat share links from Meta's personal AI agent Muse could be retrieved in bulk by strangers, with more than 6,800 links found in a single query of a DNS history database. When Muse shares a chat, it generates a webpage viewable without login and writes the chat title and a random ID into the domain name; after the page is opened, the full domain name may be recorded by third-party DNS services. A spot check of several hundred found dozens of sensitive documents, including internal corporate revenue reports, small-business loan applications, and preparation materials for a candidate's confidential recruiting communications with a frontier AI lab. Claroc reported to Meta on October 8 and published its research on October 18; Meta did not confirm suspension of the chat sharing feature until October 20, after Ars Technica intervened with inquiries. The 40 links previously viewable without login had all become invalid on recheck, but chat titles remained in DNS history records. Zuckerberg last month also called Muse a product "designed from the ground up for privacy and security."