Meta Pauses Muse Sharing After Privacy Flaw Found
Researchers at Claroc reported that Muse AI share links were discoverable, exposing conversations that users had chosen to share.
Updated on Oct. 31, 2026 in Cybersecurity
Live Poll
Do you trust AI assistants to keep your shared conversations private?
Meta has paused the sharing feature of its Muse AI assistant after Claroc researchers reported a privacy vulnerability that exposed shared conversations. The flaw allowed thousands of share links to be enumerated, and several hundred examined by researchers contained sensitive information.
Why it matters
The issue shows how a design choice in share-link structure can expose private AI conversations to anyone who finds them. Users of AI assistants that offer sharing features may need to reconsider what they make public.
Researchers enumerated thousands of Muse share links through passive DNS searches, and several hundred of those examined contained sensitive information. The number of affected users and whether any exposed data was accessed beyond the researchers has not been disclosed.
The players
Meta
Meta is the technology company that operates the Muse AI assistant and its sharing feature, and has paused sharing while reviewing the reported flaw.
Claroc
Claroc is a security research firm that identified the vulnerability and named the discoverable pages GhostShares.
Asaf Aprozper
Asaf Aprozper is the chief technology officer of Claroc, who reported the findings to Meta through its bug bounty program.
The details
Muse share links used the shared domain cf.metaaiusercontent.com, with the conversation title embedded in the subdomain. Because passive DNS records historical domain resolutions, researchers could find these links by enumerating subdomains. Claroc CTO Asaf Aprozper reported the findings through Meta's bug bounty program on October 8, and Meta acknowledged receipt and suspended sharing while reviewing them.
Timeline
October 8, 2026: Claroc reports the vulnerability through Meta's bug bounty program.
October 31, 2026: Reports emerge that Meta has paused the Muse sharing feature.
The Tech Race
This flaw follows earlier security research that identified other vulnerabilities in Muse, extending scrutiny from the assistant's outputs to its link-sharing design. It adds to a pattern in which AI companies race to ship sharing and collaboration features before their privacy implications are fully tested.
Anyone who has used Muse sharing may have exposed conversations that were discoverable by others. Users who shared conversations should review what was made public and consider deleting or limiting older share links where that option is available.
The takeaway
Sharing features in AI tools can create public exposure even when users never intended content to be broadly visible. Check whether shared links from AI assistants are still active and remove any that contain personal information.
Further reading
For more on how privacy gaps like this one are found and handled, explore our Cybersecurity coverage.
Source note: This article includes information reported by RocketNews.
Live Poll
Do you trust AI assistants to keep your shared conversations private?
