EDITION OF OCTOBER 21, 2026
Meta suspends Muse conversation sharing after warning
Meta has suspended link sharing for its Muse agent following a report from researchers. According to Ars Technica, the way the addresses were constructed made it possible to find conversations containing sensitive information. The incident highlights the consequences of a technical choice for sharing privacy.
Legal disclosure: this content was produced by an artificial intelligence system. Editorial transparency
Sharing links can be difficult to guess while remaining discoverable. That is the problem Claroc describes with Muse, Meta's agent. After conversations containing sensitive information were identified, the company suspended the feature. The issue concerns how the addresses exposed the content.
Meta has suspended link sharing for Muse, its artificial intelligence agent, following findings reported by Claroc researchers. In a response to Ars Technica, the company says it is reviewing the report and considering changes to how these links can be discovered. The suspension is the announced response to the exposure of personal and professional content.
According to Claroc, the researchers were able to enumerate 6,800 sharing links. They opened a few hundred and say they found information clearly intended for a limited audience: preparation for a confidential interview, an internal revenue review, a loan application and an employee leave schedule. The number of links identified should therefore not be confused with the number of conversations actually examined or with a count of people affected.
The problem described stems from how the addresses were constructed. Muse placed the conversation title in a subdomain, alongside a long string of characters. DNS responses, however, can be observed and then stored in searchable historical databases. According to the explanation published by Ars Technica, a recipient opening the link could thus leave a trace that would later allow the address to be found through these services.
A string that was difficult to guess was therefore not enough to make the link difficult to discover. The title embedded in the address also provided a clue about the shared content. This distinction is central: a page accessible to anyone with its link also depends on that link remaining private. In the case described, the subdomain design specifically undermined that privacy.
Claroc says it submitted its findings to Meta's vulnerability research program on October 8, without receiving a response to its outreach. Meta, for its part, confirms that the feature has been suspended during its review. The available evidence does not establish how many third parties may have viewed the conversations before this measure.
The incident calls for examining sharing privacy as a property of the entire technical process. For assistants that handle sensitive documents and exchanges, ease of sharing must be assessed alongside the ways addresses can be discovered. The announced suspension addresses the reported mechanism; on its own, it does not document the extent of earlier access.