Meta Muse share links exposed private data: what was public, and what to do about your share links

Meta Muse share pages were public web pages: anyone with the link could open one without logging in. On October 18, 2026, security firm Claroc reported that it had found more than 6,800 of those links without guessing or searching, because each link's web address contained a title and had been logged in passive DNS records. Some pages held loan applications and internal business documents. On October 20, after Ars Technica asked about the research, Meta paused sharing in Muse. On October 22, Meta said the flaw was fixed and turned sharing back on, with new addresses for everything shared before the fix.

This story is based on Claroc's research post, Meta's statements (relayed by MediaNama, Engadget and TechSpot, and posted on X by Meta's David Singleton), Meta's help center and earlier coverage of similar incidents, checked October 23, 2026. Muse is the personal agent app Meta launched in the US on September 8, 2026; our Muse Spark explainer covers the app and the model behind it.

The short version

• What leaked: Muse share pages, which opened for anyone with the link. Claroc counted 6,800+ share addresses, which is not a count of sensitive chats.
• How: not search engines. A title and a random ID sat in the page's hostname, and commercial passive DNS services record hostnames when browsers look them up.
• Meta's response: sharing paused on October 20 "while we review this report"; on October 22, Meta said the issue was fixed, sharing was back on and older shares had new URLs.
• Still open: whether the new addresses still include titles, whether affected users will be told directly, and Muse-specific steps to delete a share.

What did the Muse share feature do?

When you asked Muse to share something, it published it as a page. Claroc says a "public link is the only way the teammate it is sent to can open it," with no login or access request.

The address was the problem. Muse named each page after a title, followed by a random ID, under Meta's content domain. Claroc's made-up example: home-sale-budget-9f21c8a3.cf.metaaiusercontent.com. A random ID protects a link only while nobody sees it. Every time a browser opened a share, its DNS lookup could be logged by passive DNS providers, and one query of such a service returned the hostnames, from which the links can be rebuilt. Claroc also found more than 75 saved scans of Muse share pages on urlscan.io.

Meta and Claroc describe what was shared differently. Claroc writes about shared conversations and chats. Singleton said press reports of "a flaw in chat sharing" were wrong and that "this issue was specifically about shared artifacts." In Muse, artifacts are the documents, images, code and web apps Muse creates or works on, according to Meta's help center, which says Muse won't share them externally unless you turn on sharing or approve its request.

Were Muse conversations indexed by Google?

Claroc doesn't say they were. It says its discovery "never went near a search engine," and that Muse's robots.txt asks search and AI crawlers to stay off share paths. Its point is that robots.txt controls crawling, not access: a page anyone can open isn't private because search engines skip it.

That makes this different from 2025's best-known AI sharing incidents:

• ChatGPT, July 2025: Fast Company found more than 4,500 shared ChatGPT conversations in Google results, Search Engine Journal reported on July 31, 2025. Users had ticked an opt-in "discoverable" box. OpenAI called it a "short-lived experiment" and removed the option.
• Meta AI Discover feed, June 2025: people posted personal chats to the Meta AI app's public feed without realizing others could see them. Meta added a first-share warning that "prompts you post are public and visible to everyone," Engadget reported on June 16, 2025.

In those cases, content reached search or a public feed. Muse's shares were found through infrastructure logs, which users couldn't see or opt out of.

What did researchers find in shared Muse pages?

Claroc says it opened "only a few hundred" of the 6,800+ links and describes six sensitive cases, without names or links:

1. a job candidate's notes for a confidential executive-search call with a frontier AI lab, including the lab's internal contact and meeting time;
2. a national marketing company's internal revenue review marked for its CEO;
3. a small-business owner's loan application, with the amount requested;
4. a to-do list with a bank fraud alert, a partial account number and a transaction amount and time;
5. a real-estate investor's internal report with property addresses and return, income and mortgage figures;
6. a workplace's full-year staff vacation calendar.

Claroc says most shares it opened were harmless, and that it found no evidence of misuse but can't tell whether anyone else found the links.

How the Muse share links came to light

1. Sept. 8, 2026Meta launches the Muse app in the USMeta via TechCrunch and APConfirmed
2. Oct. 8, 2026Claroc reports the issue to Meta's bug bounty programClarocReported
3. Oct. 18, 2026Claroc publishes its researchClarocConfirmed
4. Oct. 20, 2026Ars Technica reports; Meta pauses Muse sharingMeta statementConfirmed
5. Oct. 20, 2026None of 40 rechecked shares openClarocReported
6. Oct. 22, 2026Meta says the flaw is fixed; sharing returns with new URLsDavid Singleton, Meta, on XConfirmed

• Confirmed
• Reported

What has Meta said and changed?

Meta told Ars Technica on October 20 that it had "paused this functionality while we review this report," according to MediaNama; Engadget's version of the statement adds that Meta would "consider changes to how these links can be discovered." TechSpot attributes the statement to Meta spokesperson Tracy Clayton, speaking to The Verge.

On October 22, David Singleton, who works on Muse at Meta Superintelligence Labs, posted an update on X. He said some shared artifact URLs "were discoverable via passive DNS," that Meta "disabled sharing immediately," and that "the underlying issue is now fixed, and sharing is back on." Anything shared before the fix "now has a new URL," he wrote, and "anyone visiting the old link will see a note asking them to get the new one from you." He pointed researchers to the Muse bug bounty program, which he said pays up to $300,000 for valid findings.

Claroc says it reported the issue through Meta's bug bounty program on October 8, 12 days before the pause; MediaNama also reported the October 8 report. Meta's statements don't confirm the date.

On October 20, Claroc rechecked 40 shares that had opened without an account earlier in the month. None opened. But the hostnames, titles included, stay in passive DNS history, and a fix doesn't remove them.

Meta hasn't said what the new addresses look like, including whether they still contain titles, or whether it will notify people whose shares were exposed. MediaNama put questions about deletion and notification to Meta and had no answer when it published on October 22.

How do I delete a Muse share link?

Meta hasn't published Muse-specific steps for deleting a share link. Here's what its own posts and help pages do say, as of October 23, 2026:

• Old links are dead, but the share isn't. Per Singleton, items shared before the fix now have a new URL, and the old address shows a note telling visitors to ask you for the new one. If you don't want something shared any more, don't send the new link.
• You can delete the item itself. Muse's help page on managing your data says artifacts live in the Library tab, where you can tap a file and delete it. Settings > Data Controls > Reset deletes all Muse data, including chat history and files, and can't be undone. The page doesn't say whether deleting an item also removes its share.
• Sharing needs your approval. Meta's help center says Muse shares artifacts externally only when you turn on sharing or approve its request. Approvals for artifacts are under Settings > Permissions.
• The Meta AI app's steps aren't Muse's. Meta's help page "Share a link or delete a link you shared to a conversation you had with Meta AI" covers the separate Meta AI app: there, a shared link "doesn't expire," people can pass it on, and you remove it by opening the chat, tapping the menu and choosing Delete link. Claroc calls that page the closest description Meta has published of how share links behave.

What the evidence supports beyond that:

• Shared titles may stay in DNS history. If a title was sensitive, such as a client's name, deleting the page won't remove it.
• Shared content may already be copied in scans or caches, per Claroc.
• For organizations, Claroc recommends finding out who uses Muse, telling staff what a share link does, and blocking muse.ai and metaaiusercontent.com at the proxy or DNS filter if nothing else governs the app.

Other AI apps handle this differently. ChatGPT lists shared links under Settings > Data controls > Shared links > Manage, where you can delete one or all of them, and our guide to ChatGPT locked chats notes that even locking a chat doesn't remove a link you already shared.

Why it matters

Muse is built to work with your files, email and accounts, which is why its shares held business documents rather than just questions. Meta says its newer Muse Wonder models will soon power more of the app, starting with subscribers. Claroc's point is a general one: a link that "anyone with the link" can open is only as private as every system that sees the link. Other October 2026 Meta disputes: its rewritten AI-training clause and an Instagram suspension it blamed on "a Claude tool".

What's confirmed, reported and uncertain

• Confirmed: Meta paused Muse sharing on October 20, 2026, and said it was reviewing the report; on October 22 it said the flaw was fixed, sharing was back on and older shares had new URLs. Claroc's research was published October 18.
• Reported (Claroc): the 6,800+ hostnames, the six sensitive cases, the October 8 bug bounty report, and the October 20 retest of 40 shares.
• Disputed: whether chats were affected. Claroc describes shared conversations; Meta says the issue was only about shared artifacts.
• Uncertain: whether the new addresses still include titles, whether users will be notified directly, and whether deleting an item in Muse removes its share.