Meta put the titles of shared Muse conversations in a part of the web address that outside services record. Researchers at security firm Claroc found 6,800 sharing links with a single query, according to Ars Technica. [2]

Among the conversations they opened were an internal revenue review marked for a chief executive, a small-business loan application and a workplace vacation calendar. People had shared these pages by link. The design allowed strangers to find the links themselves. [2]

The mechanism is straightforward. Before a browser opens a page, it asks the internet’s address system, DNS, where to find the site. Services called passive DNS databases collect records of those lookups. Muse placed each conversation’s title and identifying text in the subdomain, the part of the address those databases can capture. Once an intended recipient opened a link, its address could enter a searchable record. [2]

A long, hard-to-guess address protects a page only while the address stays hard to obtain. Muse gave it a route into a directory. [2]

That matters because Meta designed Muse to fill forms, book appointments and make purchases. Those tasks require access to users’ accounts and bring sensitive material into its work. Sharing an output then becomes another place where that material needs protection. The model can complete the task correctly while the surrounding software exposes the result. [2]

Elsewhere this week, Latent Space reported researchers using GPT-5.6 Sol and Gemini 4 Argon to help discover and investigate PHP2Shell, vulnerabilities in PHP, software that runs websites. Researchers reported working exploits; maintainers and security providers coordinated fixes and temporary protections. That is evidence of useful security work beyond a benchmark score. [1]

The two reports expose the distance between finding software flaws with AI and securing a product that uses it. A model-assisted investigation can uncover a defect deep inside PHP. It does not establish that a separate agent’s sharing system keeps confidential work confidential. Each path by which information leaves the product still needs its own examination.

For the person whose revenue review became discoverable, the failure occurred after the conversation was ready to share. Meta told Ars it had suspended that feature while reviewing the report and considering changes. Muse’s route from private work to a shareable page is now closed during that review. [2]