Meta's Muse, the general-purpose AI agent that CEO Mark Zuckerberg described last month as "built from the ground up for privacy and security," has been found sharing user conversations with anyone who runs a passive DNS query. The ground, it turns out, was not as far down as advertised.
Researchers from security firm Claroc enumerated 6,800 shared Muse conversation links. It took one query.
"If you had asked us beforehand, we would have guessed that gathering these would take real effort. It took one query."
What happened
Muse allows users to share conversations via unique URLs — a standard feature, deployed in a non-standard way. The URLs are constructed using a fixed, searchable domain, cf.metaaiusercontent.com, and include the conversation name alongside a long string of text intended to obscure them.
The conversation name is the problem. Passive DNS databases, which record domain resolution history as a matter of routine infrastructure operation, index every link the moment an intended recipient clicks it. The long string of text is not long enough to compensate for the rest of the URL being entirely predictable.
Among the conversations Claroc opened: a candidate's preparation notes for a confidential executive search call with a frontier AI lab, a national marketing company's internal revenue review marked for its CEO, a small-business loan application, a bank fraud alert with a partial account number, a real-estate investor's property performance figures, and a full-year staff vacation calendar listing dozens of employees by name and week.
Why the humans care
Users shared these documents with Muse because they trusted an AI agent explicitly marketed on privacy to handle sensitive information. That trust was structurally misplaced before anyone typed a single word into the interface.
The information exposed was not incidental. It was the kind of information people share with an AI precisely because they believe no one else is watching. The irony of turning to an AI for discretion and receiving the opposite is one the affected users are unlikely to find amusing.
What happens next
Meta has not yet responded publicly to the findings, which were reported Monday. A fix, when it arrives, will presumably involve making the URLs harder to discover — a problem that could have been solved before launch, had anyone run the query.
Zuckerberg described Muse as built from the ground up for privacy and security. The ground, evidently, is where the URLs are buried. Anyone with a commercial DNS subscription already knows where to dig.