Meta's Muse AI assistant let private chats, including HR data, leak onto the open web
A design flaw in Muse's share-link feature let researchers find thousands of private conversations, including a workplace's full-year vacation calendar, with a single search.
What happened: Security firm Claroc reported that Meta's personal AI agent Muse, launched September 8, built shareable conversation links in a way that made them discoverable through public internet traffic records, without anyone handing out the link. Claroc found more than 6,800 Muse share pages this way and opened a few hundred. Among them: a candidate's notes for a confidential executive-search call, a company's internal revenue review, a small-business loan application, a bank fraud alert with account details, a real-estate investor's financial report, and a workplace's full-year staff vacation calendar. Meta paused the sharing feature after Claroc and Ars Technica raised the findings, saying it is reviewing how the links can be discovered.
Why it matters: Two of the exposed documents sit squarely in workplace territory: an HR vacation calendar naming dozens of employees against the weeks they'd be out, and sensitive hiring notes from a confidential executive search. Claroc warned that absence lists like this are useful for anyone attempting fraud or impersonation. None of this came from a sanctioned company rollout; Muse needs no admin approval, so any employee can sign up and link it to personal email or calendars. Surveys cited in the reporting show this is common: 65% of organizations recently found staff using unapproved AI tools with sensitive data, and a third of those found HR or personal employee data involved.
How it works, plainly: When a Muse user clicked share, the app generated a web page anyone with the link could open, similar to many chatbot share features. But Muse built each page's address from the conversation's own title plus a short code, rather than a long, unguessable string. Every time someone opened a shared page, that readable address got logged in passive DNS records, commercial databases that track which web addresses have been visited. Claroc searched those public records and the conversation titles effectively worked as a table of contents, revealing what many pages held before anyone even clicked them.
The rollout: Meta says it is reviewing the report and considering changes before restoring sharing; it had called Muse 'built from the ground up for privacy and security' at launch, and the app drew an estimated 2.8 million downloads in its first two weeks. Claroc reported the flaw through Meta's bug bounty on October 8, says it did not bypass any controls, and withheld all names and links from its public write-up. For employers, the episode is pushing HR, legal and IT teams to spell out, for the first time in many policies, what happens when an employee clicks 'share' on an AI chat.