Meta’s New AI Leaks Users’ Intimate Information

Jakarta, CNBC Indonesia — Meta’s artificial intelligence agent, Muse, was found to be openly exposing users’ personal information. A link-sharing feature intended to make it easier for users to share content instead allowed anyone to access confidential conversations, including financial details, company documents and information about users’ personal lives, CNBC Indonesia reported on Wednesday (21 October 2026).

When Muse users wanted to send their conversation history to someone else, the system generated a dedicated link. Security researchers found, however, that these links were indexed and could be found with a simple search. Without permission, anyone could access thousands of conversations shared by other users simply by searching for patterns in the link addresses.

The exposed content included highly confidential information such as income details, loan applications, bank transaction records, company financial reports and personal holiday schedules.

“We suspected that collecting all of this would take a great deal of effort. It turned out to take just one search,” wrote researchers from cybersecurity company Claroc.

Muse had previously been found to keep detailed records about users’ friends and family, effectively creating profiles of people known to users without notifying them or obtaining their consent. Meta founder Mark Zuckerberg, meanwhile, has repeatedly said the technology was built with privacy and security fully protected.

Meta has disabled the sharing feature since the problem came to light, but observers warn that this may only be the beginning. Unless the core systems that manage data are fixed, similar vulnerabilities could emerge in other features.

The case is a reminder that information sent to artificial intelligence systems may spread more widely than users expect. Users are advised not to share confidential information, bank account numbers, personal documents or work data with AI chat services unless it is absolutely necessary and their security has been verified.