Meta has restored sharing in Muse after researchers found sensitive pages, including a loan application and an internal revenue review, through searchable records of internet address lookups. The company says it fixed the flaw and replaced every previously shared artifact’s URL. People opening an old link now get a notice asking them to obtain the replacement from its owner.
The October 22 restoration followed a two-day pause. In a statement reproduced by The Next Web’s Ana Maria Constantin, Meta’s David Singleton said the problem affected shared artifacts, the standalone outputs Muse creates, rather than private chat sharing. The distinction matters for an agent that can use connected accounts to book appointments, make purchases and complete forms: the demonstrated exposure involved material published through sharing, with no reported entry into users’ accounts.
The surprising detail is that nobody needed to guess the supposedly secret links. Security firm Claroc says one search returned more than 6,800 share hostnames, the site-address portion of those links. Each included a descriptive title and a random identifier. The identifier made an address difficult to guess, but it could still appear intact in a searchable record.
Opening a web page requires a DNS lookup to find the server behind its hostname. Passive-DNS services retain lookups observed by their monitoring infrastructure. Muse’s old design placed both the share’s title and random identifier in that hostname, so an observed lookup could reveal enough to reconstruct the link. A person finding that record could then open the shared page without receiving the link from its owner.
Claroc opened a few hundred pages without signing in. Most were unremarkable, it said, but a minority contained sensitive material. Its examples included a small-business loan application showing the amount requested and a marketing company’s revenue review marked for its CEO. A property investor’s report contained two addresses and exact mortgage, income and return figures.
Other pages exposed less obvious kinds of private information: a staff calendar listed when dozens of employees would be away; a task list included a bank fraud alert with a partial account number and transaction details. Notes for a confidential recruitment call with a frontier AI lab named the internal contact and meeting time. Claroc withheld identifying details and did not contact the people involved, so it could not establish their intended audiences. Ars Technica’s Dan Goodin reported the same findings, relying on Claroc’s research.
The numbers describe different things. The Associated Press reports that Mark Zuckerberg said more than 10 million people in the United States and Canada had set up Muse accounts. That is the product’s reach, not the number exposed.
| Reported measure | What it establishes |
|---|---|
| More than 10 million account setups | Muse adoption, according to Zuckerberg; not a count of people who shared material. |
| More than 6,800 hostnames | Share addresses Claroc found in one passive-DNS dataset after filtering scan noise; not a count of sensitive pages or affected users. |
| A few hundred pages opened | The sample Claroc inspected. Sensitive material was a minority. |
| Six sensitive categories described | Examples of exposed content, not a complete inventory of the incident. |
Claroc says it reported the issue through Meta’s bug bounty program on October 8. On October 20, all 40 previously accessible shares it rechecked failed to load. That supports the shutdown for those pages, without establishing that every old share was disabled. The firm found no evidence of misuse, but could not determine how long pages had been reachable or whether others had already found them.
Meta’s explanation of why private chats were unaffected rests on the sharing boundary. Its artifact documentation describes outputs that can exist outside chat, with approval required for external sharing. Claroc did not report retrieving an unshared private conversation. It did, however, repeatedly call the exposed material shared conversations. Its redacted examples do not establish every field a shared artifact could contain, including whether surrounding messages, uploads or information from connected accounts could appear. Meta’s categorical distinction therefore remains the company’s account of the scope.
The replacement URLs address known old links, according to Meta. Whether they prevent the same discovery mechanism from recurring is not established in the published evidence. Singleton’s statement gives no replacement URL structure, and Claroc’s last update predates the restoration. Neither source documents a post-fix test showing whether titles or access identifiers remain visible in DNS. Historical records of the old hostnames, including their titles, also remained searchable, Claroc said.
For people who shared an artifact before the fix, the immediate change is having to send recipients its new link. Our read is that the lasting privacy question concerns how that link stays within its intended audience. Approving a share tells the service to publish a page; it does not establish that the person understood its address could become part of a searchable catalog.