GoKawiilMeta's Muse AI chatbot leaked shared conversations via guessable URLs
Security researchers at Claroc found they could enumerate roughly 6,800 shareable conversation links generated by Meta's Muse AI agent due to a predictable URL-construction method. Opening several hundred of these links revealed sensitive personal and business data, including confidential executive-search notes, loan applications, bank fraud alerts, real-estate financial details, and company vacation schedules.
GoKawiil's interpretation of the reporting above, not reported fact.
The findings undercut Meta CEO Mark Zuckerberg's claim that Muse was 'built from the ground up for privacy and security,' since researchers say exposing this data required only a single query. The incident suggests that as AI assistants increasingly handle sensitive personal and workplace information, basic security practices like unguessable sharing URLs remain critical and can be overlooked even in new flagship products.
- Researchers enumerated about 6,800 shareable Muse conversation links due to predictable URL construction.
- Exposed data included confidential business notes, loan applications, bank fraud alerts, and employee vacation schedules.
- The flaw contrasts with Meta's stated claim that Muse was designed with privacy and security as core priorities.
Source: arstechnica.com, 2026-10-20
Published there as: “Meta Muse exposes users' personal and business secrets when they share conversations”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.