Meta has suspended Muse’s conversation-sharing feature while it reviews privacy, after researchers at security firm Claroc found they could enumerate links users had created.
Sharing on Muse works the way it does on most services. A user clicks an option, the platform generates a unique URL, and anyone holding that link can load the content. The protection is supposed to come from an unguessable string.
Claroc found Muse’s URL construction predictable enough to enumerate 6,800 sharing links. After opening a few hundred, the researchers found personal and business information that was evidently never meant to be public.
One query was enough
Their conclusion was blunt. Collecting that material looked like it should take real effort, and it took a single query.
Meta said it opened the Muse bug bounty program so researchers could raise different scenarios, and that the sharing feature is paused while it considers changes. Chief executive Mark Zuckerberg introduced Muse last month describing it as built from the ground up for privacy and security.
The failure mode is an old one dressed in new clothes. Share-link systems have leaked before across file storage, document editors and photo services, and the fix is always the same: long random identifiers, expiry, and revocation controls.
What is new is the payload. A shared assistant conversation can hold medical questions, contract terms and internal business detail, all in one URL that never looked sensitive.
