Meta Muse share links exposed business secrets: what small businesses should learn
Researchers at the security firm Claroc found more than 6,800 conversations that users of Meta’s AI agent Muse had shared by link, with a single search of public DNS records. Among the few hundred they opened were a small-business loan application with the amount requested, an internal revenue review marked for a CEO and a full-year staff vacation calendar naming dozens of employees. After Ars Technica asked questions, Meta paused the sharing feature. The lesson applies to every AI tool: a share link is not private.
What happened
Muse is Meta’s new AI agent. It fills out forms, books appointments, makes purchases and creates documents on its own, so it needs access to most of a user’s accounts. Like many AI assistants, it can share a conversation by link. According to Ars Technica, Muse put the conversation title into the web address itself, as part of the subdomain (simplified example: loan-application-draft-a4c9e2.cf.metaaiusercontent.com).
Once someone opens such a link, the address can be recorded in passive DNS databases, commercial services that log which domain names were looked up. Claroc searched one of them for Meta’s sharing domain and, after filtering out noise, got more than 6,800 addresses. Besides the loan application and the revenue review, the researchers list a real-estate investor’s report with two property addresses and mortgage figures, and a to-do list with a bank fraud alert and a partial account number. “It took one query,” they wrote.
Claroc says it reported the issue through Meta’s bug bounty program on 8 October. Meta told Ars Technica it has paused sharing while it reviews the report and considers changes. On 20 October, Claroc reported that 40 shares it had checked earlier no longer open, but the addresses, titles included, are still in passive DNS history.
What it means for you
- Treat every AI share link as public. If you would not publish it on your website, do not put it in an AI conversation you plan to share. This applies to every AI tool with a “Share” button, not only Muse.
- Set one simple AI rule for your team. Customer data, contracts, loan and tax documents, salaries and staff lists do not go into AI chats that get shared. Use internal files with access control for that.
- Check what is already out there. Review and delete old share links in the AI tools your team uses. Treat an AI agent with access to your email and accounts with the same caution as a new employee who gets all the keys.
2-Point Expert Read
Not sure how exposed your website is, or what AI assistants and search engines can see on it? Send me your link. Within 24 hours you get one finding about your website, one about your visibility on Google and in AI search, and a recommended next step. For small businesses and sole traders, no obligation.
Weekly AI Digest for Small Businesses
Once a week: AI news and what it means for your business.
Share this story
Sources
- Ars Technica (Dan Goodin), 20 Oct 2026: Meta Muse exposes users’ personal and business secrets when they share conversations (in English)
- Claroc Research, 18 Oct 2026: GhostShares: A Shared Muse Chat Exposed Prep for a Confidential Call With a Frontier AI Lab Leader (in English)
Claroc is a security company that sells a tool for monitoring sharing in AI apps.