Meta Restores Muse Sharing After Fixing URL Security Flaw
Meta restored Muse sharing after Claroc researchers found shared-artifact URLs, based on conversation titles, in public DNS records. The issue surfaced links to a marketing firm’s revenue review and a small-business loan application; pre-fix shares require new URLs.
Meta has re-enabled sharing in its Muse platform after temporarily disabling the feature following a security vulnerability that made shared conversation links publicly discoverable.
The issue was identified earlier in the week of October 22, 2026, when researchers at Claroc reported that web addresses for shared Muse conversations were named after a conversation’s title and written into public DNS records — making them relatively easy to find. Ars Technica reported that Meta paused the sharing feature after being contacted about the problem.
The scope of the exposure was illustrated by what researchers said they had been able to find: a marketing company’s internal revenue review and a small business owner’s loan application, both shared via Muse.
Meta’s David Singleton announced the resolution in a post on X, stating: “The underlying issue is now fixed, and sharing is back on.” Singleton clarified that the flaw affected URLs for shared Muse artifacts — described by Meta as items such as documents and images within Muse — and was not a flaw in chat sharing itself.
Users who shared an artifact before the fix was applied will need to distribute a new link. “If you shared an artifact before the fix: it now has a new URL,” Singleton wrote. “Anyone visiting the old link will see a note asking them to get the new one from you. We know that’s a pain, and we’re sorry for the disruption — but protecting user data has to come first.”
The incident highlights the potential risks of discoverable public links for tools that users may rely on to handle sensitive professional or financial information.