Meta pauses Muse sharing after researchers find exposed private information

Meta said it has paused sharing in its Muse AI agent while it examines a privacy complaint and considers changes. Security firm Claroc said shared conversations were reportedly accessible to people who had never received their links.

Claroc said a search of historical domain records identified more than 6,800 share addresses. Researchers examined several hundred pages and reportedly found sensitive material, including loan paperwork, internal financial records and partial banking details. Most pages they inspected contained ordinary material, rather than confidential information.

The reported problem involved conversation titles and random identifiers appearing in share hostnames, which domain lookup services could record. That reportedly made the addresses discoverable without guessing the identifiers. Meta introduced Muse on September 8 as an assistant that can perform tasks across connected services, with users controlling its access.

Claroc said it tested 40 previously accessible shares again on October 20 and could no longer open any of them. However, it said their hostnames, including conversation titles, remained in historical domain records. Meta said its review would consider changes to link discoverability.