That AI Draft You Just Shared With a Colleague? It Might Be Public.
October 26, 2026
On October 20, Dan Goodin at Ars Technica reported on findings from security firm Claroc about Muse, Meta's new general-purpose AI agent. Only a few weeks earlier, Meta CEO Mark Zuckerberg had described Muse as "built from the ground up for privacy and security." Yet with a single query, researchers were able to pull up 6,800 links that Muse users had created to share conversations and drafts with other people.
Nobody hacked Meta's servers to get those files, and nobody guessed a password. People simply used the built-in "Share" button the way they were supposed to, assuming the link would only be seen by the person they sent it to.
What the researchers actually found
When Claroc researchers opened a sample of a few hundred of those shared links, they didn't just find dinner recipes or vacation trivia. They found real business and personal records that were never meant to be public, including:
- A small-business owner's loan application, complete with the dollar amount requested
- A national marketing company's internal revenue review, marked for its CEO
- A real-estate investor's internal performance report, listing two property addresses alongside exact return, income and mortgage figures
- A workplace's full-year staff vacation calendar, mapping dozens of employees against the weeks each person would be away
- A to-do list containing a bank fraud alert, a partial account number and a transaction amount and time
- A candidate's preparation notes for a confidential executive-search call with an AI lab, naming the internal contact and meeting time
How did private share links end up in plain sight? Like most AI assistants, Muse creates a unique web link when you share a conversation or document. To keep outsiders from guessing the address, it tucks a random string of characters into the link.
The catch was where Meta put that text. Instead of placing the conversation title and ID in the path at the end of the web address, Muse placed them in the subdomain at the beginning, creating addresses like loan-application-draft-a4c9e2.cf.metaaiusercontent.com or q3-revenue-review-7b1e42f0.cf.metaaiusercontent.com.
Because the domain name system (DNS) has to look up a subdomain the moment the intended recipient clicks the link, that address gets logged in commercial passive DNS databases that anyone can search. Claroc called these exposed pages "GhostShares": pages that open for anyone with the link, sitting in a public directory where strangers can find them with a single search. After Ars Technica asked Meta about the research, Meta paused the sharing feature while it reviews how those links are built.
Why "be careful what you type" misses the point
Earlier this month, we wrote about how many employees are already using unapproved AI tools at work. Stories like this show what happens next. Once an AI tool helps someone draft a loan package, summarize a quarterly revenue review or lay out a staff schedule, the natural next step is handing that draft to a business partner, a CPA or a manager.
In a consumer AI app, "collaboration" almost always means generating a public web link and hoping the address is too long for anyone else to stumble across. You can warn employees not to paste sensitive numbers into free tools, but when a tool is marketed as built for privacy and includes a one-click Share button right on the screen, busy people are going to use it.
The risk here wasn't a careless employee. It was a consumer tool doing consumer-grade sharing with business-grade documents.
Where business AI actually breaks down
Most small and midsize businesses don't get burned by AI because the model gives a bad answer. They get burned in the handoffs: how data gets into the tool, where the draft lives while people work on it, and how it moves from one person to the next.
Putting real guardrails around that doesn't mean banning AI or handing your staff a twenty-page policy. In practice, it means:
- Seeing where AI is already helping people draft financials, client proposals, HR schedules or loan documents, instead of pretending those workflows don't exist.
- Moving that work out of consumer apps and into business-grade environments where "sharing a draft" checks the recipient's identity and keeps the file inside your company tenant, not on a public link anyone can open.
- Setting clear boundaries around which tools can touch your accounts, email and files, so convenience features don't quietly bypass the access controls you already rely on.
- Giving your team a fast, approved way to collaborate on AI-generated work so they never have a reason to reach for a public share link in the first place.
That's the work we do in our AI advisory engagements. We look at how work actually moves between people in your business, identify where AI can save real time without putting your records in the wrong place, and set up the right tools and permissions around it. If your team is already using AI to draft and share real business documents, now is a good time to make sure those drafts stay yours.