Meta's Muse AI shares links publicly

Meta's Muse AI, launched on September 8, 2026, lets users share conversations via a link. However, these links are not fully private, raising concerns about user data exposure.

Muse's role in Meta's AI lineup

Muse is part of Meta's broader AI family, which includes Muse Wonder, a competitor to leading AI models, and Muse Spark Open, an open-source version that runs locally on users' devices.

Security company reveals data exposure

Claroc, a security firm that monitors SaaS and AI tools for businesses, found over 6,800 shared Muse conversations using a single search query. The researchers accessed these pages without an account or login, uncovering personal and professional documents that were not meant for public view.

Meta claims Muse is secure

Mark Zuckerberg, Meta's CEO, described Muse as an AI assistant "designed from A to Z for privacy and security." However, the AI requires access to users' messaging, emails, calendars, and files, increasing the risk of data exposure.

Muse faced a security flaw

Just 12 days after its launch, on September 21, a researcher named Patrick Wardle identified a zero-day vulnerability in Muse's Mac application. This flaw allowed malware to hijack the voice dictation feature and steal the assistant's authentication token.

Muse links are structured for security

Each shared Muse conversation is assigned a unique URL hosted on the domain cf.metaaiusercontent.com. These links start with the conversation's title, followed by a random string to prevent guessing. For example: home-sale-budget-9f21c8a3.cf.metaaiusercontent.com.

DNS leaks expose links

The issue arises from DNS, the system that translates website names into server addresses. When a user opens a Muse link, their browser queries this system, and passive DNS services record the full address. This allows anyone to search for the Muse domain and find all shared links.

GhostShares reveal sensitive content

Claroc refers to these exposed links as "GhostShares," which can be accessed by people who never received the original link. While most pages contained mundane content like event calendars or advertisements, a minority included sensitive data such as confidential interview notes, internal financial reviews, and personal loan requests.

Meta ignored the report

Claroc reported the issue to Meta's bug bounty program on October 8, but the company has not responded. Meta did not immediately reply to questions from Ars Technica, which published the findings.

Researchers warn of public exposure

Claroc explains that Muse's design requires public links to function, and this is the only way recipients can open the pages. The 6,800 links found were only a sample, as the researchers only queried one passive DNS service for a short time.

Recommendations for users

Researchers advise treating shared Muse links as public and avoiding unnecessary personal information in shared conversations. They also recommend deleting the link after it has been used and being cautious with the title, which can reveal the content of the page.

Businesses should monitor use

For companies, Claroc suggests identifying employees who use Muse. If monitoring is not possible, the firm recommends blocking the domains muse.ai and metaaiusercontent.com on company devices to prevent unauthorized access.