Meta says Muse AI app has 10 million users; researchers found 6,800 discoverable share links, and Meta paused sharing

Meta CEO Mark Zuckerberg told analysts on the company's third-quarter earnings call today, Oct. 21, that the Muse AI agent app has more than 10 million users. Roughly 25% of people who set up Muse now use it daily, he said.

The same week, a security firm showed that Muse's "share" feature made thousands of user conversations findable by anyone who knew where to look.

The growth pitch

Muse launched Sept. 8, 2026. Market intelligence firm Sensor Tower estimated 10.9 million downloads in the first 40 days, with 10.2 million of them in the United States. Meta's call confirmed the 10 million user mark.

Zuckerberg said more than a quarter of Muse's engaged users who shop through the agent had an average purchase above $200. He said Plaid, the fintech company whose connector Muse uses for agentic shopping, told Meta it had not seen activity like it on any other service.

Beyond shopping, he said, people are connecting Muse to their email and calendars. He read that as proof users trust the app's security setup, which includes Muse Secure VM. A forthcoming Muse Confidential VM, he said, will prevent even Meta from seeing users' content.

Meta's plan is to keep Muse free for most people, take a percentage of commerce on the platform, and charge power users who want advanced models or more tokens. Zuckerberg said Muse could eventually generate more revenue per user than the company's family of apps, which he put at several hundred dollars a year. Meta says Muse will be profitable once it scales.

The costs are large. Zuckerberg said Muse is "very compute-intensive to run" and that Meta expects to improve cost efficiency by more than 10x within a year. Meta reported third-quarter revenue of $64.60 billion, up 26% from a year earlier, and its 2026 capital expenditure guidance stands at $130 billion to $145 billion, mostly for AI.

What Claroc found

On Monday, Oct. 19, researchers at security firm Claroc reported that Muse's share links could be enumerated. Every shared page sat under the domain cf.metaaiusercontent.com, and each address included the conversation's title plus a long random string.

That design put the full address into public DNS records. Passive DNS services log those lookups, so a single search returned a list of shared pages by name. "One passive-DNS search brings back thousands of them, listed by name, like a table of contents," Claroc wrote in a blog post.

Claroc counted more than 6,800 share hostnames. The researchers opened only a few hundred. Most were ordinary content. A minority held sensitive material, including:

• A candidate's notes for a confidential executive-search call with a frontier AI lab, naming the lab's internal contact and the meeting time
• A marketing company's internal revenue review marked for its CEO
• A small-business owner's loan application, with the amount requested
• A to-do list with a bank fraud alert, a partial account number, and a transaction amount and time
• A real-estate investor's performance report with two property addresses and return, income and mortgage figures
• A workplace's full-year staff vacation calendar listing dozens of employees

The 6,800 figure is a count of share addresses, not of confirmed sensitive conversations. The problem also covered only pages users chose to share. It did not expose every private Muse chat. Claroc said it found no evidence of misuse and withheld names, hostnames and figures.

"If you had asked us beforehand, we would have guessed that gathering these would take real effort," the researchers wrote. "It took one query."

Meta's response

Claroc co-founder and CTO Asaf Aprozper said he reported the findings through Meta's bug bounty program on Oct. 8 and also tried to reach Meta staff on LinkedIn. He said he got no reply either way.

Meta's emailed statement framed sharing as working as designed. "People have the ability to share specific Muse artifacts, which creates a page that can be accessed by those with the link," the company said. "However, we've paused this functionality while we review this report and consider changes to how these links can be discovered."

That is Meta's position: the pages were link-accessible by design, and the open question is discoverability. Claroc's position is that a link nobody was supposed to find turned out to be listed publicly. Claroc said its researchers could no longer open a sampling of previously accessed links after Meta's update.

Sharing a link is a choice, and users who paste loan applications and fraud alerts into any chatbot carry some responsibility for where that goes. But Zuckerberg said last month that Muse was "built from the ground up for privacy and security," and users had no reason to expect a share link to be indexed in DNS records.

Why the two stories collide

Meta's revenue case for Muse rests on users handing it their calendars, inboxes and payment connections. Zuckerberg cited that willingness on today's call as evidence of trust.

The share-link flaw is a design error in a single feature, and Meta has switched it off. It is also a reminder that agentic products collect exactly the kind of financial and workplace detail that Claroc found sitting in shared pages.

Meta has given no date for restoring sharing and has not said what the redesign will involve. It also has not said whether it will notify people whose shared chats were discoverable. The Confidential VM Zuckerberg promised is still forthcoming, so how Meta fixes sharing is the first test of that privacy pitch.