Meta's Muse Shares More Than Users Intended: 6,800 Links Exposed

Researchers at security firm Claroc say they enumerated 6,800 share links created by users of Muse, Meta's new general-purpose AI agent, and found sensitive personal and business information behind them. The report landed Monday, roughly a month after Meta CEO Mark Zuckerberg said the assistant was "built from the ground up for privacy and security."

The irony requires no assistance. It also requires no exclamation mark.

The mechanics of the failure are mundane, which is precisely what makes them instructive. Muse lets users share searches, conversations and images by generating a unique URL, the same pattern used by countless online services. The security of such links rests on one assumption: the string of characters in the URL must be long enough, and random enough, that nobody can guess it. A share link is a lock with one key, and the key is printed on the door.

What did the researchers actually find?

Claroc reported that a central design decision in how Muse constructs its URLs made them easy to discover rather than hard to guess. The researchers did not need to breach a server or exploit a deep software flaw. They enumerated 6,800 links, opened a few hundred, and read what they found.

The contents, according to the researchers, were clearly not intended for public consumption. The source material describes the exposed material as personal and business secrets, including information from shared Muse conversations. The gap between 6,800 enumerated links and a few hundred inspected ones is worth noting; the researchers sampled, and the sample was enough.

Why does a share link matter so much?

For an AI agent such as Muse, the stakes run higher than for a conventional chat service. A general-purpose assistant sees what users search, what they upload, and what they ask it to remember. When the share mechanism leaks, it leaks the entire relationship between user and agent, not merely one message. A spreadsheet shared by mistake is embarrassing. An AI conversation is a confession.

Meta has not, in the reported material, disputed the findings or detailed a fix. The company's public positioning, in Zuckerberg's words, is that Muse was "built from the ground up for privacy and security." That phrase now sits in the record alongside 6,800 enumerable links, and readers may weigh the two claims as they see fit.

What is the likely commercial consequence?

Muse is a new product carrying a general-purpose remit, which means it handles business context as routinely as dinner plans. Corporations evaluate assistants on trust before they evaluate them on capability, because a capable leak is worse than a limited one. Security researchers, not marketing, will set the early adoption curve here.

The episode also fits an established pattern. Share-link enumeration flaws have surfaced across the industry for years, usually with the same root cause: insufficient entropy in the identifier. It is the digital equivalent of a combination lock shipped from the factory set to 1-2-3-4. Vendors fix it after someone opens a few hundred doors.

For now, the practical guidance writes itself. Users who share Muse conversations should assume the link may be discovered, not merely received. Anyone who has shared business material through the feature should treat it as circulated.

Claroc's disclosure gives Meta a concrete engineering task: randomize the identifier space, invalidate existing links, and do so before the next researcher counts higher than 6,800. How quickly that happens will tell the market more about Muse's security posture than any launch-day statement.