Meta Restores Muse Sharing After Privacy Vulnerability

The vulnerability was identified earlier this week by researchers at Claroc, who found that web addresses for shared conversations were predictable and easily discoverable. Following an inquiry from Ars Technica, Meta paused the tool to prevent further data exposure. David Singleton, a representative for Meta, confirmed today that the issue stemmed from how URLs were generated for shared artifacts—such as documents and images—rather than the chat-sharing functionality itself.

To mitigate the risk of unauthorized access, the company has implemented a mandatory link rotation. Any artifact shared prior to the fix now requires a new URL, rendering old links inactive. Users attempting to access previous shares will instead encounter a notice prompting them to request a fresh, secure link from the original owner. While acknowledging the inconvenience, Meta stated that the disruption was a necessary trade-off to prioritize user data protection.