Meta pauses Muse sharing after Claroc finds link-accessible pages

Meta says it paused Muse’s sharing functionality while it reviews Claroc’s report and considers changes to how share links can be discovered.[1] The feature creates a page that people can access if they have its link.[2] Claroc said it reported the issue to Meta’s bug bounty program on October 8.[3] Meta told Ars Technica it was suspending sharing after the outlet asked about Claroc’s findings.[4] The evidence does not describe a broader suspension of Muse or say when sharing might return.[1]

Claroc said it found the links with one query.[2] It said Muse builds each share address from the conversation title and a random ID under the domain cf.metaaiusercontent.com.[3] Claroc also said passive-DNS providers can record a share hostname when someone opens a link and their browser looks it up.[3] After opening a few hundred pages, Claroc said most were harmless, including small-business sites, listings and event calendars.[3] Among the more sensitive examples were notes for a confidential executive-search call, an internal revenue review marked for a CEO, and a loan application.[2]

Other examples Claroc reported included a to-do list with a bank fraud alert and partial account number, an investor’s internal property-performance report, and a workplace calendar listing employees’ planned weeks away.[2] Claroc said its findings covered one discovery channel and one hostname pattern, so they do not establish Muse’s total exposure.[3] When Claroc rechecked 40 previously accessible shares on October 20, 2026, it said none opened.[4] It also said the share hostnames and titles remained in passive-DNS history after the pages stopped opening.[4]

Claroc said Muse launched on September 8, 2026.[4] Sensor Tower projected that Muse would reach 5 million downloads 22 days after its US launch, faster than ChatGPT, Grok and Claude.[3] Meta says Muse can send emails, book travel, fill out forms and make purchases for users.[3] Ars Technica reported that Muse requires access to most of a user’s accounts to work as intended.[2] Ars also reported that a macOS security expert discovered a zero-day vulnerability three weeks after launch, which could let another app on the same device gain complete control of a user’s Muse account.[2]