Meta Turns Muse Sharing Back On After Guessable Links Exposed Private Files

Meta has re-enabled sharing in Muse, its AI assistant, after researchers reported that public links to shared Muse content were easy to find. The Verge reported the change on October 22, 2026.

The exposed material was not abstract. Researchers were able to locate shared Muse pages that included a marketing company's internal revenue review and a small business owner's loan application. Both were reachable by anyone who had the address.

According to researchers at Claroc, the web addresses for shared Muse conversations were named after each conversation's title and written into public DNS, the Domain Name System that maps readable web names to server addresses. Because the names followed a predictable pattern and the DNS entries could be looked up by anyone, outsiders could list likely addresses and check them without any credentials.

Meta paused the sharing feature after being contacted about the issue. The company said the problem lay with URLs for shared Muse artifacts and was not a flaw in chat sharing. Meta defines artifacts as things like documents and images created inside Muse, which places the fault in how generated content was addressed rather than in the conversation layer itself. David Singleton, speaking for Meta, said the underlying issue is now fixed and sharing is back on.

Artifacts shared before the fix now carry new URLs. Visitors to the old links are shown a note asking them to request the new link from the person who shared it. That closes the old addresses to casual discovery, but anyone who copied a link before the change will have to be told where it moved.

The timing is awkward for Meta. Muse was rolled out on October 8 as an assistant that can, according to Breakingviews, send emails, sell a car and book travel on a person's behalf. Four days later, on October 12, Meta announced the Muse Wonder and Muse Wonder Full models, which it describes as frontier models for agents. Access to Muse Wonder requires a paid subscription to the Muse app, as CNBC reported. Meta's third-quarter results, reported on October 20, drew attention to its AI spending and to how quickly people are adopting the Muse personal assistant, according to Reuters.

In my view, the chat-versus-artifact distinction Meta draws is accurate in engineering terms but will carry little weight for the person whose loan application was found. A user does not experience a conversation and a generated document as separate products, and both leave the same kind of trail when shared. The question for anyone building agent features is whether the addressing scheme assumes content stays private unless someone reveals it. Title-derived slugs, the readable tail of a URL, and public DNS records answer that question the wrong way.

The broader context here is that agents raise the stakes of sharing. A chat assistant that drafts a memo produces content a user may want to pass along. An agent that sends email, transacts and books travel produces content tied to accounts, payments and personal data. Sharing features designed for the first case will be tested against the second, and the review that matters is the one applied to every object an agent creates, not only to conversations.

The fix described is the practical kind: a change to URL generation, a notice on old links, and sharing restored once the flaw was addressed. Shareable artifacts remain a useful unit of work for people who want to pass a document or image to a colleague, and that utility depends on links that are unguessable and easy to revoke. If the addressing model is rebuilt around that expectation, the feature can do what its designers intended without making private work discoverable by accident.