Meta’s Muse: some users call it a girlfriend, and a sharing flaw left 6,800 chats discoverable

Meta has paused the sharing feature in Muse, its new AI agent, after a security firm found more than 6,800 shared conversations that could be traced through public DNS records. Some contained loan applications and confidential business documents. Claroc published its findings on 18 October. Meta told The Verge it had “paused this functionality while we review this report”.

The flaw came to light just as a different kind of story about Muse was spreading: adults forming romantic attachments to it. Fox News reported on 23 October that some users now describe the agent as a girlfriend. Taken together, the two stories are a reminder of how much people tell an AI that remembers them.

What Muse is, and why people get attached

Meta launched Muse on 8 September as a personal agent that handles tasks and learns about its user. It remembers past conversations, can message you without being prompted and has a customisable avatar. It is rated 18+. When WIRED tested it, Meta confirmed that Muse can hold sexual conversations with adults if the behaviour is legal. A Meta spokesperson later told Fox News the product “doesn’t block legal adult behavior”.

Memory, unprompted messages and a face are what make companion apps feel personal, and Muse now has all three inside a general-purpose assistant. Fox News noted that there is no evidence Muse experiences feelings. Our guide to what AI companions give you and what they take looks at why that kind of design draws people in.

How the shared chats were exposed

Sharing a Muse chat created a public web page that anyone with the link could open without logging in. Each page’s address included the conversation’s title and a random ID. According to Claroc, opening a link triggered a DNS lookup, and commercial “passive DNS” services recorded the full address. That made the pages findable without the link. Claroc says it reported the issue to Meta’s bug bounty programme on 8 October.

Claroc opened only a few hundred of the 6,800-plus addresses. Among them it found a loan application, a bank fraud alert, a revenue review meant for a CEO and a staff holiday calendar. On 20 October, the 40 links it rechecked no longer opened. The firm notes, however, that the titles remain in DNS history. Claroc sells security tools, and its write-up recommends steps that its products address.

What this means if you confide in an AI

None of the exposed chats Claroc describes were romantic. Still, people often share the same kind of detail with an AI they feel close to: names, addresses, money worries and private photos. Some practical steps:

• Treat “share” as “publish”. On any AI app, a shared link may be readable by anyone who finds it. Don’t share intimate or identifying conversations.
• Watch the titles. In Muse’s case, chat titles ended up in public records even after the pages went offline.
• Check training and memory settings. Meta says Muse conversations may be used to train its models with key personal identifiers removed, and users can opt out. Fox News reports that Meta has not said whether resetting Muse removes data already used for training.
• Be wary of intimate chats. Experts quoted by Cybernews warned that explicit AI conversations could become material for hackers or extortion if they leak.

For the wider picture, from age checks under California’s Adam’s Law to the questions raised by Character.AI’s bankruptcy sale, see our AI companions hub.

Sources

• Claroc, Muse shared conversations and passive DNS, 18 October 2026 (updated 20 October)
• The Verge, Meta pauses Muse chat sharing, October 2026
• TechSpot, 21 October 2026
• Fox News, “Why some people are falling for Meta’s Muse AI”, 23 October 2026
• Cybernews, citing WIRED’s test of Muse, 13 October 2026

Cover photo: Tat Linh Nguyen / Unsplash