Claroc's research team described the findings in a blog post dated October 18, 2026, and Ars Technica reported on the findings at 20:33 Beijing time on October 20. Muse is the general-purpose AI agent Meta launched on September 8, according to Claroc.
What Claroc found
Claroc says that when a user asks Muse to share a conversation, Muse publishes it as a page that anyone with the link can open without logging in, and that this is by design. The issue Claroc raises is that the links can also be discovered without being shared. According to Claroc, the way Muse builds its share addresses means the addresses end up in public DNS records, where anyone with access to that data can search the records.
Claroc says a single search returned more than 6,800 share addresses and that the researchers opened only a few hundred. "If you had asked us beforehand, we would have guessed that gathering these would take real effort," the researchers wrote. "It took one query."
According to Claroc, most of the pages it opened were unremarkable, such as small-business sites and event calendars. A minority held sensitive material. Claroc lists those pages by category only: a candidate's preparation notes for a confidential executive-search call with a frontier AI lab, a company's internal revenue review, a small-business loan application, a to-do list containing a bank fraud alert, a real-estate investor's internal performance report and a workplace's full-year staff vacation calendar. Claroc says it has no evidence that anyone has misused the shares.
Meta has not responded
Claroc says it reported the issue to Meta's bug bounty program on October 8. Asaf Aprozper, Claroc's co-founder and CTO, told Ars Technica that the company contacted Meta and "never received a reply." Ars Technica wrote that "a Meta representative didn't immediately have answers to questions sent by email."
Aprozper also told Ars Technica that, after checking similar platforms and Muse's documentation, Claroc "determined that this behavior is by design," and that users should know a shared chat "creates a public link that can be discovered." Ars Technica advises Muse users to limit the personal information in shared conversations and to delete share links as soon as possible.
Background: Confidential VMs are not live yet
Separately, TestingCatalog reported at 20:32 Beijing time on October 20 that a "Confidential VMs" option is in the works on the Muse website. According to TestingCatalog, a hidden setting says conversations will run in a secure, encrypted environment and that the feature will at first be available only to Meta AI subscribers, without voice mode, image and video generation or wearables support. TestingCatalog says Meta has previously said the feature will arrive before the end of 2026. The feature has not launched, and the release date is unclear. TestingCatalog's report does not connect the feature to share links.
