The team said it was able to enumerate 6,800 share links that Muse users had created.
All of them use the domain cf.metaaiusercontent.com and place the conversation's title in the web address, followed by a long string of characters, which makes them discoverable through passive DNS searches.
Passive DNS records are searchable histories of how domain names resolved to IP addresses, and a record is created once someone clicks a share link.
Meta has marketed it as deserving that level of trust, and the app climbed to one of the top spots in Apple's App Store.
Titles in the example links, such as a home-sale budget, a quarterly revenue review and a loan application draft, show how personal and business details could surface.
Claroc calls these pages "GhostShares" because they open for people who were never given the link and can find it on their own.
Claroc said many AI assistants share by public link, but that the title in Muse's address is what makes these easy to find.
Claroc co-founder and CTO Asaf Aprozper said the company contacted Meta and received no reply, and concluded after reviewing similar platforms and Muse's documentation that the behavior is by design. A Meta representative did not immediately answer emailed questions. The report follows a separate flaw found three weeks after launch by macOS security expert Patrick Wardle, which let another app on the same device take full control of a user's Muse account. Meta downplayed it because exploitation required an already compromised device, though Wardle found that a simple ClickFix attack could be enough to hijack an account. For now, users are advised to limit the personal information they discuss in conversations and to delete share links as soon as possible.