Meta’s Muse assistant was built to handle sensitive work — from documents and bookings to purchases — but its sharing feature quickly became a test of whether that trust was warranted.

Earlier this week, researchers at security firm Claroc said they could enumerate 6,800 Muse sharing links with a single query, after the service embedded conversation titles in hostnames recorded by public DNS systems.¹ The results, they said, included a marketing company’s internal revenue review, a loan application, a bank-fraud alert and workplace vacation schedules.

Claroc called the pages “GhostShares”: links that could be opened by people who had never received them, because the title in the address made them searchable. “It took one query,” the researchers wrote, challenging the assumption that the long strings attached to shared URLs made the material effectively private.¹ The researchers said the behavior appeared to be by design and urged users to limit sensitive details in chats and delete shared links quickly.

Meta initially paused sharing after the problem was reported. It has now restored the feature, with David Singleton saying on X that “the underlying issue is now fixed, and sharing is back on.”²

The company’s account narrows the problem: it says the flaw involved URLs for shared Muse artifacts, such as documents and images, rather than chat sharing itself. But the practical remedy is broad for anyone who shared content before the fix. Those artifacts have been assigned new URLs; visitors to old ones are told to request the replacement link from the original sender.²

Meta acknowledged the inconvenience, saying it was sorry for the disruption but that “protecting user data has to come first.”² For Claroc, however, the episode is a reminder that an AI assistant’s privacy promises depend not only on what it stores, but on how easily its shared output can be found.