Researchers found thousands of shared AI chats sitting in public internet records, among them employee absence data and a job candidate's confidential search prep
Somewhere in the United States, a workplace's entire year of staff vacations was sitting on the open web this month: dozens of employees, each lined up against the week they would be away. Nobody hacked it. Someone asked an AI agent to share it.
The calendar was one of the documents that security firm Claroc found while investigating Muse, the personal AI agent Meta launched on Sept. 8. In research published Oct. 18, Claroc said it located more than 6,800 Muse share links without anyone handing them over and opened a few hundred. Most were mundane. Some were not, including a job candidate's notes for a confidential executive-search call with a frontier AI lab, down to the lab's internal contact and the meeting time.
Meta has since paused the feature.
"People have the ability to share specific Muse artifacts, which creates a page that can be accessed by those with the link," Muse spokesperson Tracy Clayton said in a statement to The Verge. "However, we've paused this functionality while we review this report and consider changes to how these links can be discovered."
But for HR leaders, the episode is less a story about one product than a preview of a governance problem that is already inside most organizations.
How a share button became a public directory
Muse, like many AI tools, lets users share a conversation by generating a link that opens for anyone who has it. Meta's help page on sharing AI conversations says as much: people with the link can see the chat, and the link does not expire.
The twist, according to Claroc, is in how Muse built those addresses. Each one started with the conversation's own title, followed by a random code. When anyone opened a shared page, that full web address was logged by commercial services that record internet domain lookups, and those records can be searched. The result read like a table of contents, with titles describing what each page held before anyone clicked.
"It took one query," the researchers wrote.
Claroc said it reported the issue to Meta's bug bounty program on Oct. 8, did not log in or bypass any controls, and has no evidence anyone misused the pages. It withheld every name, title and link from its write-up.
It is not Muse's first security headline in its six weeks on the market. In late September, Reuters, citing The Information, reported that Meta was adding a clearer safety warning inside the app after an outside researcher found a separate flaw that could have exposed a user's cloud-based workspace. The app has been popular regardless: Sensor Tower estimated about 2.8 million downloads in its first two weeks, according to Reuters. Mark Zuckerberg had introduced Muse as "built from the ground up for privacy and security."
Why this lands on HR's desk
Of the six sensitive pages Claroc described, two sit squarely in HR territory. The vacation calendar is employee data, and it is also a map of when specific people are out of the office, which is useful to anyone attempting fraud or impersonation. Claroc made the same point, warning that lists like this are ready-made for social engineering. That concern overlaps with the growing debate over who owns workforce identity risk, where a recent Entrust survey found just 8 percent of IT and security leaders say HR or the CHRO owns it.
The executive-search notes point to a quieter risk. Candidates, recruiters and hiring managers increasingly use AI to prepare for interviews, and a confidential search is only as confidential as the least careful person in the loop. Claroc noted that while a candidate's biography might be public, the fact that a particular meeting is happening is not.
None of the exposed content came from a corporate rollout. Muse needs no admin approval, so employees can sign up on their own and connect it to their email and calendars. That is the textbook definition of shadow AI, and HR data is already caught up in it. In Kiteworks' 2026 Data Security and Compliance Risk survey, 65 percent of organizations said they had discovered employees using unapproved AI tools with sensitive company data. Among those, 31 percent found employee personal and HR data flowing through the tools.
Having a policy on paper does not settle it either. When accounting network Plus More ran an internal audit, it found staff using unregistered AI tools on work devices despite an existing rule.
"We've learned that having a policy is not enough; teams need to hear the key messages clearly, repeatedly, and in different ways," said Anna Crow, the group's head of people and culture.
Some employees will cut corners anyway. A 2025 CalypsoAI report found 52 percent of U.S. employees said they would use AI to make their jobs easier even if it breached company policy.
What HR leaders can do now
Most AI acceptable-use policies focus on what employees type into a chatbot. Few say anything about the share button, which turns a private conversation into a published web page. That gap is the clearest lesson from Muse, and it is one HR can close without waiting for IT.
Start by naming sharing explicitly. Guidance should tell employees that an AI share link is a public page, not a private message, and that anything involving colleagues' personal data, candidates or compensation should never be shared that way. Recruiting teams deserve their own briefing, since they handle some of the most sensitive information in the company and often work across personal devices and outside platforms.
Next, find out what is already in use. Claroc recommended treating Muse like any other unapproved app and checking who is using it. For organizations that cannot monitor it, the firm suggested blocking the Muse domain and its content domain on managed devices as a stopgap.
Finally, decide who owns the rules. Policies on outside AI tools are being written by different functions at different companies, according to Andy Challenger of outplacement firm Challenger, Gray & Christmas, who discussed shadow AI and AI-linked job cuts with HRD.
"Sometimes they're coming from the legal team. Sometimes they're coming from IT teams. Sometimes they're coming from HR. Hopefully, all three are involved," he said.
Gartner analysts made a similar case this week, urging employers to align AI value with AI risk through shared governance.
Three questions to ask about AI share links
- Does our AI use policy say what happens when someone clicks "share," and who may see the result?
- Which consumer AI agents are connected to work email, calendars or HR systems, and did anyone approve them?
- Do recruiters and hiring managers know what candidate information can and cannot go into an AI tool?
Meta may well fix the way Muse builds its links. The next tool may make a different mistake. Claroc's own summary is the one worth pinning to the policy page: "Nobody broke in. The tools work this way, and people use them."
