AI News Feed
Market watch
AMD to Bring FSR 4.1 Upscaling to Xbox Series X/S and Ally HandheldsNVIDIA releases Cosmos3-H-Dreams for real-time generative surgical simulationCalifornia School Data Breach May Affect Up to 17 Million StudentsPaper from Wang Youqing's team accepted by ACM MM 2026Chrome to Warn Users Before Opening 'Suspicious' SitesGrafana Labs unveils AI agents to automate AI observability
AMD to Bring FSR 4.1 Upscaling to Xbox Series X/S and Ally HandheldsNVIDIA releases Cosmos3-H-Dreams for real-time generative surgical simulationCalifornia School Data Breach May Affect Up to 17 Million StudentsPaper from Wang Youqing's team accepted by ACM MM 2026Chrome to Warn Users Before Opening 'Suspicious' SitesGrafana Labs unveils AI agents to automate AI observability
Cybersecurity

Meta Pauses Muse Conversation Sharing After Researchers Find 6,800 Public Links

Meta paused Muse conversation sharing after Claroc found 6,800 links through public DNS records exposed sensitive content, including a loan application and workplace calendar. The incident comes as Sensor Tower says Muse reached 10.9 million downloads since September.

AI News Feed · 2026-10-21 03:14

The researchers, from security firm Claroc, said they enumerated 6,800 links that Muse users had created to share conversations, according to a report cited by Ars Technica and The Verge. After opening a few hundred, they found information that was clearly not intended to be publicly available. The Verge reported that the exposed material included a marketing company's revenue review, a small business owner's loan application, a workplace's full-year staff calendar and notes for a job candidate's call with an AI lab.

Claroc said the problem came from how Meta built share URLs. Muse used the share title, a short phrase describing the conversation, plus a random ID, and placed that title in the subdomain rather than the URL path. All the links used the domain cf.metaaiusercontent.com. Once a recipient clicked a link, DNS information was recorded in passive DNS databases, which store historical domain-to-IP resolutions and can be searched through commercial services. A single query was enough to pull the links, the researchers said. Simplified examples included home-sale-budget-9f21c8a3.cf.metaaiusercontent.com and q3-revenue-review-7b1e42f0.cf.metaaiusercontent.com. The hostname often revealed what a page contained before anyone opened it.

Meta spokesperson Tracy Clayton said in an emailed statement to The Verge that people can share specific Muse artifacts, creating a page accessible to anyone with the link. "However, we've paused this functionality while we review this report and consider changes to how these links can be discovered," Clayton said. Ars Technica reported that Meta suspended the sharing feature while it considers changes.

The incident is sensitive for Meta because CEO Mark Zuckerberg said last month that Muse was "built from the ground up for privacy and security," according to Ars Technica. The exposure also follows earlier cases in which AI sharing features made conversations more public than intended. The Verge reported that conversations with OpenAI's ChatGPT, Anthropic's Claude and xAI's Grok have appeared in Google Search results.

The privacy problem emerged alongside rapid growth for Muse. Sensor Tower data reported by TechCrunch AI showed the app had 10.9 million downloads since its September debut, including 10.2 million in the United States. It reached 10 million U.S. downloads in its first 40 days, a milestone only 11 other apps have reached, Sensor Tower Senior Insights Analyst Kara Lee said. Meta has marketed Muse across its family of apps and increased advertising. Meta allocated 39% of its total ad spend to market Muse in October, up from 23% in September, and the app ranked 21st in U.S. advertising impressions this month, up from 73rd in September.

Sensor Tower also found that Muse had a 30% U.S. retention rate after seven days and 23% after 14 days, compared with an average of 19% and 16% for ChatGPT, Claude and Grok. Muse's daily active users reached 2.5 million for the first time on October 16, a 15% week-over-week increase. ChatGPT had 3.7 million U.S. downloads in its first 40 days, while Grok and Claude had 500,000 and 200,000, respectively, according to the data. Muse is available only in the U.S. and Canada for now, while ChatGPT drew early downloads from markets including Japan, Brazil and Germany.