Meta Muse AI leaks: one query found 6,800 shared conversations

A single search query was all it took for security researchers to enumerate 6,800 links to conversations shared through Meta's new AI agent, Muse. Opening a few hundred of them revealed personal and business secrets that were never meant to be public, according to a report Monday from security firm Claroc. The finding undercuts the privacy promise Meta CEO Mark Zuckerberg made last month when he said Muse was "built from the ground up for privacy and security."

The vulnerability is not a hack in the traditional sense. Muse, like many online services, lets users share searches, conversations, images, and other content by generating a unique URL. Those URLs typically contain a long, random string of text designed to be unguessable, so only people with the link can view the content. But Claroc found that Muse's central design decision for constructing those URLs made them easy to discover. A single query was enough to list thousands of conversations by title, and the researchers were able to open a few hundred of them to find information that was clearly not intended to be publicly available.

The exposed data included personal and business secrets, according to the researchers, though the full scope of what was visible is still being assessed. The report did not specify exactly what types of information were found, but the implication is that anyone who shared a conversation link could have inadvertently exposed sensitive details to strangers. For a product positioned as a general-purpose AI agent, that is a significant trust gap. Users may have shared meeting notes, financial figures, health details, or proprietary plans, all under the assumption that a long URL meant privacy.

The timing is awkward for Meta. Zuckerberg's "built from the ground up for privacy and security" comment was meant to differentiate Muse from rivals like OpenAI's ChatGPT and Google's Gemini, which have faced their own privacy scrutiny. But this discovery suggests that even a well-intentioned design can fail when security relies on obscurity rather than authentication. The URLs may have been long and random, but if they are enumerable, they are effectively public. Security through obscurity is a fragile defense, and this is a textbook case of why.

This is a classic security through obscurity failure. Many platforms use unguessable URLs to protect shared content, a practice that works only if the URL space is large enough and the generation process is truly random. When a service makes those URLs predictable or searchable, the protection evaporates. For enterprises, the lesson is clear: any tool that allows sharing by link should be treated as potentially public unless access controls are enforced on the server side. A single query turning into thousands of exposed conversations is not an edge case; it is a systemic design flaw.

The stakes go beyond individual users. Muse is Meta's entry into the AI agent race, a category that promises to handle tasks like scheduling, research, and communication on behalf of users. If those agents can leak conversation histories, businesses that adopt them for internal workflows could face compliance and reputational risks. Regulators in the EU and elsewhere are already scrutinizing AI products for data protection failures, and a vulnerability like this could invite enforcement action. Under GDPR, a data breach involving personal data can trigger notification obligations and fines, and enumerable links could be interpreted as a lack of appropriate technical measures.

Meta has not yet publicly responded to the findings, and it is unclear whether the company has fixed the issue or plans to. For now, users who have shared Muse conversations should assume those links may be discoverable and should avoid sharing anything sensitive through the feature. The broader lesson for AI vendors is that privacy claims must be backed by rigorous security testing, especially when a product is new and eager to win users. Independent researchers are actively probing these tools, and a single flaw can undermine months of marketing.

For competitors and customers alike, this is a reminder that the AI agent race is still early, and trust is the currency that will separate winners from also-rans. A single flaw can undermine months of marketing. The companies that build sharing features with authentication, access controls, and audit logs will have a durable advantage over those that rely on obscurity. Meta may patch this specific issue, but the reputational damage is already done, and every enterprise evaluating Muse will now ask a harder question: what else is exposed?