Meta has re-enabled sharing capabilities for its Muse SI tool, following a security incident where researchers discovered that public links to shared artifacts were easily discoverable.
What Happened
Security researchers at Claroc reported that web addresses for shared conversations from Muse were generated based on conversation titles and written into public DNS records. This configuration allowed external parties to locate specific Muse pages, including sensitive documents such as a marketing company’s internal revenue review and a small business owner’s loan application. Ars Technica reported that Meta paused the sharing feature after being contacted about the issue. On October 22, 2026, Meta’s David Singleton confirmed on X that the underlying issue was fixed and sharing was restored. Singleton noted that the flaw affected URLs for shared Muse artifacts—defined by Meta as documents and images within the tool—rather than chat sharing itself. Users who shared artifacts prior to the fix were issued new URLs, with old links displaying a notice directing visitors to obtain the new address from the sender.
Why It Matters
The incident highlights the security challenges associated with generating and managing public links in SI tools that produce shareable artifacts. While the vulnerability was not in the SI model's reasoning or chat interface, the predictability of the URLs in the DNS layer exposed user data to potential scraping or accidental discovery. This event underscores the importance of robust security practices in the infrastructure supporting SI applications, particularly when handling sensitive business documents generated by users.
The Bottom Line
Meta has fixed the URL structure for Muse SI artifacts and resumed sharing. Previous links are no longer valid, and users must retrieve new URLs to access shared content.