← All cases

Meta Muse share links exposed business documents to people who were never sent them

On October 20, 2026, Ars Technica reported that researchers at the security firm Claroc found more than 6,800 links people had made to share conversations from Muse, Meta's new AI agent. It took one search of public DNS records. In the few hundred they opened, they found a small-business owner's loan application, a company's internal revenue review, a bank fraud alert with a partial account number, and a workplace's staff vacation calendar. Meta said it paused the sharing feature while it reviews the report.

What went wrong

Users asked Muse to create a share link, and anyone with the link could open the page. Each link put the conversation's title inside the web address. When someone opened a link, public DNS records could log that address, so other people could find the links on their own. Claroc said it has no evidence anyone misused the shares.

What to do

• Don't use share links for chats that mention clients, money or staff. Send a short summary or a PDF instead.
• Open your AI tool's list of shared links and delete the ones you no longer need.
• Before you share a chat, ask yourself: would I be fine with this on the back of a postcard? If not, don't send the link.

Sources

• arstechnica.com: https://arstechnica.com/security/2026/10/meta-muse-exposes-users-personal-and-business-secrets-when-they-share-conversations/
• qz.com: https://qz.com/meta-muse-ai-shared-conversation-links-dns-102026
• pcworld.com: https://www.pcworld.com/article/3267268/meta-just-reminded-us-that-sharing-ai-chats-is-a-terrible-idea.html