Meta's AI made "private" share links easy to find
Muse is Meta's new AI agent. It writes documents, fills in forms and has a share button that makes a link only the people we send it to should see.
Researchers at the security firm Claroc found about 6,800 of those links without being sent any. "It took one query," they wrote. Among the pages they opened: a small business loan application, a company revenue review, a bank fraud alert with part of an account number and a full year staff holiday calendar.
The trick was simple. Muse put each page's title in the link itself, and opened links end up in public internet lookup records that anyone can search.
Meta paused sharing on 20 October, changed the links and switched sharing back on two days later.
Why it matters: we are giving AI agents our email, calendars and bank details. "Anyone with the link" can mean more people than we think.
Would we share a document an AI made for us? Tell us below.
Read the full story
8
7
3
3
3
2October 23, 2026 898
