To be honest, I'm mainly running this one because of the cartoon

Security researchers at Claroc enumerated 6,800 shareable conversation links created by users of Meta's AI agent Muse, finding that a central URL-construction design decision made the links easy to discover and exposed sensitive material including executive-search notes, internal revenue reviews, loan applications, and bank fraud alerts. Separately, AI safety researcher Karan Joshi extracted Muse's internal prompts and told Wired the agent maintains a "page for every person in the user's life," updating profiles of users' friends and family roughly hourly. Meta CEO Mark Zuckerberg had said the assistant was "built from the ground up for privacy and security.

Via @newyorker.com $META \ image or embed\ https://bsky.app/profile/did:plc:z6rujpf4u56jfie7aqic2nfg/post/3myb4gtn6nk24?ref src=embed @carlquintanilla.bsky.social https://bsky.app/profile/did:plc:z6rujpf4u56jfie7aqic2nfg?ref src=embed October 19, 2026 at 2:57 PM https://bsky.app/profile/did:plc:z6rujpf4u56jfie7aqic2nfg/post/3myb4gtn6nk24?ref src=embed What could possibly go wrong? Joe Wilkins writing for Futurism https://futurism.com/future-society/meta-muse-surveillance-privacy-friends-family : Meta’s new AI agent Muse might come with a cutesy new mascot, but under its fuzzy exterior lies a vast surveillance network under the control of one of the world’s most powerful — and least accountable — tech companies. The flashy new service has gained plenty of traction over the past few weeks, with many reviewers praising its utility in everyday life — as Eli Tan wrote for the New York Times https://www.nytimes.com/2026/09/22/technology/meta-muse-ai-agent.html , he was “blown away,” calling it the “most useful AI app I had ever used.” But as researchers dig beyond the surface of Meta’s new AI offering, it’s becoming clear that Muse comes with a major drawback: users aren’t just signing their own privacy rights away, but those of their friends and family as well. As Wired reports https://www.wired.com/story/muse-creates-detailed-profiles-of-all-your-friends-and-family/ , the AI agent keeps detailed files on people on the periphery of its users’ lives, regularly scooping up new information about them. These updates are reportedly coming once an hour, with an internal instruction for Muse to maintain a “page for every person in the user’s life.” “What it seemed like to me — from all these prompts, system skills data, and things that they’re feeding into Muse — is that they want to understand your relationships that you have with real people,” Karan Joshi, an AI safety researcher who extracted Muse’s internal prompts and shared them with Wired , told the magazine. In other words, Joshi says “they’re trying to know you like a friend, which is honestly pretty creepy.” And Dan Goodin writing for Ars Technica https://arstechnica.com/security/2026/10/meta-muse-exposes-users-personal-and-business-secrets-when-they-share-conversations/ : Muse, which Meta CEO Mark Zuckerberg said last month https://arstechnica.com/security/2026/09/muse-metas-extraordinarily-privileged-ai-assistant-has-a-serious-0-day/ was “built from the ground up for privacy and security,” seems to take the same precautions. But a central design decision for constructing URLs has made the links easy to discover. As a result, researchers from security firm Claroc said https://blog.claroc.io/ghostshares-muse-passive-dns/ they were able to enumerate 6,800 links Muse users created for sharing conversations with others. After opening a few hundred of them, the researchers found information that was clearly not intended to be publicly available, including: - a candidate’s notes preparing for a confidential executive-search call with a frontier AI lab, naming the lab’s internal contact and the meeting time - a national marketing company’s internal revenue review, marked for its CEO - a small-business owner’s loan application, with the amount requested - a to-do list that included a bank fraud alert, with a partial account number and a transaction amount and time - a real-estate investor’s internal performance report, with two property addresses and exact return, income, and mortgage figures - a workplace’s full-year staff vacation calendar, listing dozens of employees against the week each one would be away “If you had asked us beforehand, we would have guessed that gathering these would take real effort,” the researchers wrote. “It took one query.” ... Muse quickly catapulted to one of the top spots in Apple’s App Store. The assistant autonomously fills out forms, books appointments, makes purchases, creates documents, and carries out all kinds of other actions. To work as intended, Muse requires access to most of a user’s accounts. Meta has heavily marketed the assistant as a platform that’s worthy of the extraordinary trust it needs to work as intended. Three weeks after the Muse launch, macOS security expert Patrick Wardle discovered a zero-day vulnerability https://arstechnica.com/security/2026/09/muse-metas-extraordinarily-privileged-ai-assistant-has-a-serious-0-day/ that allowed any other app installed on the same device to gain complete control of the user’s Muse account. Meta downplayed the severity of the vulnerability on the grounds that exploitation wasn’t possible unless a device was already compromised. The company didn’t acknowledge Wardle’s finding that a simple ClickFix attack https://arstechnica.com/security/2026/09/clickfix-attacks-infecting-pcs-and-macs-are-going-viral/ was all that was needed to hijack an account. The ease in discovering share links further justifies asking if Muse is worthy of the access it requires.