Meta Pauses Muse Sharing After Loan, Revenue Chats Exposed

Meta has paused the feature that lets people share conversations from Muse, its AI agent, after the security firm Claroc reported that more than 6,800 Muse share links could be found through public DNS records. Ars Technica reported the pause on 20 October 2026, after Meta answered its questions by email; The Verge later quoted part of that statement, attributed to Muse spokesperson Tracy Clayton.

Claroc says the pages it opened included a small-business owner’s loan application and a marketing company’s internal revenue review. As we read it, the finding lands while banks and retailers decide how far to let Muse into their systems, as our earlier coverage reported.

Business Pill · LEAST PRIVILEGE

A one-minute explainer of least privilege: giving each system or person only the access a task needs. It teaches the general idea only and says nothing about any company in this story.

What Claroc Found

Claroc says it searched a commercial passive-DNS service and, after filtering out noise, found more than 6,800 Muse share hostnames. Ars Technica reports that after opening a few hundred of them, the researchers found information that was clearly not intended to be publicly available, including:

• a small-business owner’s loan application, with the amount requested
• a national marketing company’s internal revenue review, marked for its CEO
• a workplace’s full-year staff vacation calendar
• a candidate’s notes preparing for a confidential executive-search call with a frontier AI lab

“If you had asked us beforehand, we would have guessed that gathering these would take real effort,” the researchers wrote. “It took one query.” Claroc also says: “We have no evidence that anyone has misused these shares.”

Why the Links Could Be Found

A Muse share link opens for anyone who has it, which is how sharing is meant to work. The problem Claroc describes is how the address was built. “Muse builds each share’s web address from the share’s title, a short phrase describing the conversation, then a random ID,” Claroc says, as quoted by The Verge.

Passive DNS services keep a searchable history of the web addresses that computers look up. Once someone opened a share, its full address, title and random ID included, could end up in that history. Ars Technica puts it this way: “It’s this last design decision, putting the conversation title in the subdomain rather than in the URL path, that makes public discovery possible.”

The Verge notes that this isn’t the first time AI sharing features made chats more public than intended, citing shared conversations from OpenAI’s ChatGPT, Anthropic’s Claude and xAI’s Grok that appeared on Google Search.

What Meta Said and Did

Meta’s statement to Ars Technica reads: “We opened the Muse bug bounty program so researchers could raise different scenarios and help us continue improving the product. People have the ability to share specific Muse artifacts, which creates a page that can be accessed by those with the link. However, we’ve paused this functionality while we review this report and consider changes to how these links can be discovered.”

Asaf Aprozper, Claroc’s co-founder and CTO, told Ars Technica he reported the findings through Meta’s bug bounty program on October 8 and also tried reaching people at Meta on LinkedIn, but got no reply. In a 20 October update, Claroc says 40 shares it had opened earlier no longer opened, and adds: “The hostnames themselves, titles included, are still in passive-DNS history.”

Ars Technica notes that Mark Zuckerberg said last month Muse was “built from the ground up for privacy and security”, and that in September a macOS security researcher reported a separate Muse vulnerability, whose severity Meta downplayed.

Connecting the Coverage

Earlier today we reported that Muse reached 10.2 million US downloads in 40 days, with 30% of US users returning after seven days, according to Sensor Tower data reported by TechCrunch.

On 19 October we reported that Amazon and JPMorgan barred it from parts of their services, and that piece’s 20 October Update covered RBC weighing a block on Muse’s access to customer data. We have also set out the licence terms on Meta’s two open-weight Muse models, and how Meta’s Commercial Terms treat what Meta may do on other businesses’ sites.

As we read it, the share-link finding adds a second trust question to the one the banks raised: not only what Muse can reach, but what its users send out of it.

The Structural Read

As we read it, the 6,800 figure counts findable links, not proven harm: Claroc opened only a few hundred of them and says it has no evidence anyone misused the shares.

As we read it, the pause closes the pages but not the record: Claroc says the hostnames, titles included, remain in passive-DNS history.

As we read it, the finding sits beside the access decisions we have covered: Amazon and JPMorgan barring Muse from parts of their services, and RBC weighing a block on its access to customer data.

Three Implications

6,800+ LINKS Claroc says a passive-DNS search returned more than 6,800 Muse share hostnames after it filtered out noise.

REPORTED 8 OCTOBER Claroc’s CTO told Ars Technica he reported the findings through Meta’s bug bounty program on October 8.

SHARING PAUSED Meta said it has paused the functionality while it reviews the report and considers changes to how these links can be discovered.

The Business Engineer Lens

This story maps onto the Business Engineer framework The Agentic Harness War.

The framework lists what now limits agent adoption: “The limiting factors are organizational readiness, governance, workflow redesign, training, and trust.”

As we read it, the Muse share links are a trust test of that kind: a design choice around the model, not the model itself. The framework was published in July 2026 and does not discuss Muse sharing.

What Is Not Established

Claroc says it has no evidence anyone misused the shares, and it opened only a few hundred of the 6,800-plus hostnames, so how many contained sensitive material is not known. The sources do not say how many Muse users created share links, when sharing will return or what Meta will change. The sources we read include no statement from a regulator.

The Bottom Line

Meta said on 20 October that it had paused Muse conversation sharing after Claroc reported more than 6,800 share links findable through public DNS, some holding business and personal records such as a loan application and a revenue review. As we read it, an agent that asks for access to most of a user’s accounts is now being judged on everything around the model, including how a shared link is built.