It also looks like they just stole the mascot design from the game Fall Guys

...to someone other than Meta, I assume?

It already has access to all your personal info in order to work.

Not a particularly well-written article. The referenced Ars Technica article actually explains the problem:

Muse has allowed users to share searches, conversations, images, and similar content with other people. Such share features usually involve clicking an option to create a unique URL that anyone can use to load a page hosting the content. To keep potentially sensitive information from being accessible to unintended people, the URLs typically contain a long sequence of text that can’t be easily guessed.

... a central design decision for constructing URLs has made the links easy to discover. As a result, researchers from security firm Claroc said they were able to enumerate 6,800 links Muse users created for sharing conversations with others. After opening a few hundred of them, the researchers found information that was clearly not intended to be publicly available.

Claroc researchers were able to discover the Muse share links because all of them use the domain name cf.metaaiusercontent.com. Discovery is further made easy by the decision to add the conversation name to the URL, along with a long string of text... It’s this last design decision, putting the conversation title in the subdomain rather than in the URL path, that makes public discovery possible.

https://arstechnica.com/security/2026/10/meta-muse-exposes-users-personal-and-business-secrets-when-they-share-conversations/

investigators were able to easily open chat logs containing detailed private information, including corporate revenue documents, loan applications, bank transaction details, income details, and one workplace vacation calendar

I'm genuinely shocked that people thought it was a good idea to put any of that into Muse in the first place.

TLDR;

They make dns records for each shared chat log. Dns records can then easily be looked up and accessed

Unsafe: My-convo-with-PHI.aimetacontent.com Safe: Aimetacontent.com/l/random-hash/my-convo-with-PHI

As Ars Technica reported today, security researchers found Muse is capable of exposing sensitive information on its users through web links generated via a “share” feature.

It's always the share feature isn't it?

Meta promised an AI built from the ground up for privacy, then built a handy directory of strangers’ loan applications and bank records. Researchers needed one query. At this point Zuckerberg calling something »private« is less a security guarantee and more a spoiler warning.

If you're trusting Meta with any information, you're a fool.

The best way to not have your private information leaked by AI is to not use it.

Join me next week for more cybersecurity tips

This isn’t even regular Facebook casual abuse of user data.

This is just straight up slop coded failure to even consider security.

The source article does a much better job explaining. It doesn't seem like the author of this article understood what they were describing.

Apparently, the problem is that all you need to know to access the shared data is the DNS hostname, and the DNS hostname is intentionally shared with third-party DNS resolvers and unintentionally published through services that collect unsecured DNS requests. It kind of makes sense that you would want to put the shares on different DNS domains because they're different browser security origins and that makes it more difficult for cross site scripting, and then if the DNS domain already uniquely identifies the share, why put something more in the path? But putting a required unique value in the path would have prevented this because the path is sent encrypted to Facebook's servers only.

This is the kind of top notch work I expect from Facebook employees. Or AI. Probably AI, let's be honest.

looks around

Anyone? Nobody? No one...surprised?

Thought so.

No shit......

The only people who could possibly be surprised by this are the kind of people that would install Muse…

…unfortunately it’s unlikely they will see this headline

Wasn't there a whistleblower saying it was only a matter of time before this happened just a few weeks ago?

Maaan, they're gonna feed those leopards to death at this rate.