The Ars Technica byline is Dan Goodin – Oct 20, 2026 8:33 am. The page does not give a time zone. The judgment first: Claroc says it counted 6,800 share links and opened a few hundred of them, and Meta has paused sharing while it reviews the report.
[1]
The deck says Meta is suspending the sharing feature while it investigates the privacy issue. The article says Muse can expose sensitive information when users share conversations through web links. Researchers reported it on Monday. After Ars asked, Meta said it is suspending sharing, reviewing the report, and considering changes. The figure 6,800 comes from the security firm Claroc, not from an audit Meta published. They say they enumerated 6,800 links that Muse users created to share conversations, then opened a few hundred of them. A few hundred is not all 6,800. The article does not say what was in the ones left unopened.
[1]What they saw after opening links is listed as six kinds of material, each described as clearly not meant to be public. First, notes preparing for a confidential executive-search call with a frontier lab, naming an internal contact and the meeting time. Second, a national marketing company’s internal revenue review, marked for its CEO. Third, a small-business owner’s loan application, with the amount requested. Fourth, a to-do list that included a bank fraud alert, a partial account number, and a transaction amount and time. Fifth, a real-estate investor’s internal performance report, with two property addresses and exact return, income, and mortgage figures. Sixth, a workplace’s full-year staff vacation calendar, listing dozens of employees against the week each would be away. The article does not print the account digits, and this piece does not add them. The amounts and addresses are not copied into the sentences here either.
[1]Meta’s emailed statement says it opened the Muse bug bounty so researchers could raise different scenarios and help keep improving the product. People can share specific Muse artifacts, which creates a page that someone with the link can open. The statement then says this functionality is paused while Meta reviews the report and considers changes to how these links can be discovered. That last clause is Meta’s own wording. It says a change is under consideration. It does not say the change is done.
What Mark Zuckerberg said last month is reported here as: Muse was built from the ground up for privacy and security. The few hundred opened shares sit in the same article as that sentence. The pause came after Ars asked, not at the product’s launch.
Asaf Aprozper, Claroc’s co-founder and CTO, said he reported the findings through the bounty on October 8 and also tried to reach people at Meta on LinkedIn, with no reply either way. Meta’s pause statement came after Ars asked. The article does not say whether sharing stayed open between October 8 and this October 20 story.
Ars closes by saying that, with sharing suspended, Muse users no longer face this particular exposure, at least for now. That is a judgment about this one feature. It does not say every other entrance has been checked.
[1]