Meta’s Muse exposed private chats through more than 6,800 links

One search request was enough

Muse generated a web link when a user wanted to share something, such as a conversation with the agent. The URL included an AI-generated chat title and a random string of characters.

But when someone opened a link, its full address was added to a dataset used for search—a kind of directory of visited links. Claroc searched that dataset for Muse pages and found links to conversations shared by other users.

The researchers said they expected collecting the data to take substantial effort. Instead, they said, one query was enough.

The chat logs they could open contained company income documents, loan applications, banking and income details, and an employee vacation calendar from one organization.

Meta told Ars Technica it had disabled the feature. The incident adds to a troubled first month of public access to Muse: earlier this month, a report said the agent gathered detailed information about users’ friends and relatives, following an internal instruction to keep a separate “page for every person in the user’s life.”

A sharing feature with a wider audience

I think the revealing detail is not just what the logs contained, but how little work Claroc says it took to find them. A sharing link is meant to give its recipient access; here, the address also became discoverable through a dataset that users would not expect to search.

The announcement does not say how many people’s information was exposed, or whether anyone beyond the researchers accessed it. Those gaps matter: disabling the feature stops the route, but does not answer how far the exposure reached.

Muse’s first public month is already accumulating privacy and security failures. The immediate fix may close this one path, but the harder test is whether users can trust the agent with personal information when its own handling of that information remains under scrutiny.