Meta‘s newly launched artificial intelligence assistant, Muse, is facing serious security questions after researchers discovered that more than 6,800 user-generated conversation links could be located through publicly accessible internet records. The vulnerability, identified by cybersecurity firm Claroc and dubbed “GhostShares,” potentially exposed sensitive personal and corporate information, including loan applications, financial records, business documents, and employee schedules. The problem stemmed from Muse’s sharing feature, which generated discoverable web addresses that could allow unauthorized individuals to access conversations without receiving links directly from their owners. Meta has temporarily suspended the sharing function while reviewing its security. The discovery raises troubling questions about the company’s privacy safeguards, particularly as millions of Americans embrace AI assistants capable of accessing financial information, emails, and other confidential records.
Key Takeaways
• Thousands of conversations exposed: Researchers identified more than 6,800 discoverable Muse sharing links, potentially exposing confidential financial documents, business records, and personal information to unauthorized parties.
• Security protections questioned: The vulnerability involved discoverable web addresses rather than sophisticated hacking, raising concerns about Meta’s security testing and its assurances that Muse was designed to protect user privacy.
• Growing risks from AI assistants: Meta suspended Muse’s sharing feature, but the incident underscores the dangers of granting increasingly autonomous AI systems access to sensitive personal and business information.
In-Depth
Meta’s ambitious expansion into artificial intelligence has encountered a significant privacy controversy after cybersecurity researchers uncovered a weakness in its Muse assistant that made thousands of supposedly limited-access conversations discoverable online.
Researchers at Claroc identified more than 6,800 sharing links through publicly accessible DNS records. The addresses contained descriptive conversation titles and identifiers that allowed outsiders to locate shared material without obtaining links directly from their creators. Exposed information reportedly included loan applications, financial statements, corporate revenue reports, and confidential business discussions.
The discovery is particularly concerning because Muse operates beyond the capabilities of conventional chatbots. Designed to handle shopping, email, scheduling, and financial transactions, the assistant can access substantial amounts of personal information when users authorize those connections.
Meta has temporarily disabled the affected sharing feature while evaluating changes. However, suspending access does not resolve the larger question of whether adequate safeguards accompanied the product’s rapid introduction.
The incident follows earlier reports of Muse vulnerabilities involving potential unauthorized account access. Together, these discoveries raise legitimate concerns about security oversight at a company entrusted with enormous quantities of personal information.
For consumers, the lesson extends beyond one company’s technical failure. Convenience should never require surrendering meaningful control over private information. Businesses and individuals must recognize that sharing confidential material with autonomous AI systems introduces risks that traditional privacy protections may not adequately address.
As artificial intelligence becomes increasingly integrated into everyday financial and professional activities, technology companies must demonstrate that their security practices deserve public confidence before demanding greater access to Americans’ private lives.
Sources
• https://nypost.com/2026/10/21/tech/metas-muse-ai-leaves-users-vulnerable-to-identity-theft-report/
• https://www.theverge.com/tech/1014627/meta-muse-ai-sharing-ai-chats
• https://www.techspot.com/news/114283-meta-suspends-muse-sharing-after-sensitive-documents-turn.html
• https://www.eweek.com/news/meta-muse-chat-exposure/
• https://research.meta.ai/blog/security-and-safety-for-ai-agents-our-approach-with-muse