Key points
- Claroc researchers enumerated 6,800 public Meta Muse conversation links using a single passive DNS query.
- The exposed data included confidential executive search notes, internal revenue reviews, and bank fraud alerts.
- Meta CEO Mark Zuckerberg had previously stated the AI agent was built from the ground up for privacy and security.
Researchers from security firm Claroc reported on Monday that a single query allowed them to find thousands of Meta Muse conversations containing sensitive personal and business information. The general-purpose AI agent, which allows users to share content via web links, inadvertently made these links easy to discover due to a central design decision in how the URLs are constructed. This exposure occurred despite public assurances from Meta leadership regarding the platform's security foundations.
How it unfolded
- On Monday, Claroc researchers published findings showing that Muse share links could be enumerated with minimal effort.
- The team used a passive DNS search through commercial services to identify 6,800 unique links created by users.
- After opening a few hundred of these links, researchers accessed data that was clearly not intended for public viewing.
- The discovery contradicted statements from Meta CEO Mark Zuckerberg last month that the service was built for privacy.
Who is affected
The exposed data belonged to various individuals and organizations who had shared their Muse conversations. Among the findings were a candidate’s notes for a confidential executive-search call with a frontier AI lab, which named an internal contact and the meeting time. A national marketing company’s internal revenue review, marked for its CEO, was also accessible. Additionally, a small-business owner’s loan application, including the requested amount, was found in the open links.
Other sensitive documents included a to-do list with a bank fraud alert, a partial account number, and transaction details. A real-estate investor’s internal performance report was exposed, listing property addresses, exact returns, income, and mortgage figures. Furthermore, a workplace’s full-year staff vacation calendar was accessible, listing dozens of employees against the specific weeks they would be away from their jobs.
What happens next
Claroc researchers noted that gathering this information took only one query, contrary to expectations that it would require significant effort. The ease of discovery stems from the way Muse constructs its share URLs, which allows passive DNS systems to track them. These systems collect historical DNS responses from sensors at recursive resolvers, creating records when they observe domain resolutions. This mechanism allowed the researchers to map out the publicly accessible links without needing to guess complex identifiers.
As Circuit Observer reported on 2026-10-12, Meta recently introduced two new AI models, Muse Wonder and Muse Wonder Full, for Muse Code subscribers and API users. The current exposure involves the general-purpose AI agent Muse. Users who have shared conversations via links should assume that any data contained in those links may have been indexed by passive DNS infrastructure and is potentially accessible to anyone with the right tools.
The background in plain language
Share links often appear private because they use long, random strings that are hard to guess. However, if a service does not properly isolate these links from public internet infrastructure, they can be indexed by external monitoring systems. Teams usually assume that a unique link equals privacy, but this is not always true. Check whether your organization’s sharing policies account for how links are resolved by global DNS networks. Understanding that links can be passively collected helps administrators set better expectations for what "private" sharing actually means in cloud-based AI tools.
What to do and how to stay safe: Meta
- Audit all previously shared Meta Muse conversation links to determine if they contain sensitive or confidential information.
- Revoke access to any active share links that you no longer need to keep public or available to specific individuals.
- Monitor passive DNS records for your domain to detect if new share links are being indexed by external monitoring services.
- Educate staff on the risks of sharing sensitive data via web links, even those that appear to be private or unique.
Step-by-step guide: Mobile Device Security for Small Business: Control Without Cost
General security guidance from the Circuit Observer newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
How many Meta Muse links were exposed in this incident?
Claroc researchers enumerated 6,800 links that Muse users had created for sharing conversations with others.
What kind of sensitive information was found in the exposed links?
The links contained executive search notes, internal revenue reviews, loan applications, bank fraud alerts, and staff vacation calendars.
How were the researchers able to find these links so easily?
They used a single passive DNS query through commercial services to discover the URLs, which were easy to enumerate.
