HOW DRU CATCH SEES IT
The Vault With No Back Wall
Mark Zuckerberg personally promised that Muse was built on "privacy and security." A month later, security researchers at Claroc discovered that the AI's share links used predictable URLs on cf.metaaiusercontent.com - complete with helpful filenames like "loan-application-draft" and "home-sale-budget" - turning every private document into a searchable public library. The researchers said they expected real effort would be required. It took one query.
The World's Most Helpful Leak Filed Everything Alphabetically
This is the tech-industry equivalent of installing a state-of-the-art vault door and leaving the combination taped to the handle. Muse was supposed to be a "cyber secretary" handling your emails, travel, and finances. Instead, it became the world's most efficient document leak, helpfully organizing your private information into labeled folders for strangers. The URLs weren't even randomized properly - they contained the AI-generated conversation title right there in the address. Your loan application wasn't just exposed; it was indexed by subject line.
Meta's Privacy Fires Are Now a Subscription Service
And here's the part that should make your eye twitch: this isn't even Meta's only privacy fire this month. Per the same reporting, Meta glasses wearers claimed the specs were listening to them even in sleep mode - a white notification light activating during normal conversation. So Meta built an AI that shares your secrets and glasses that eavesdrop on your small talk, and the guy who greenlit both of them stood on stage last month talking about privacy like he invented the concept. Muse has paused the feature "while we review this report," which in Meta's dialect means "while we figure out how this got caught before we figured it out." When the security firm's one-query hack exposes 6,800 links including someone's CEO-only revenue doc, the product wasn't a privacy tool. It was a filing cabinet with no drawers.




THE COMMENTS SECTION HAS ENTERED THE CHAT
When a CEO personally promises "privacy and security" for a product that is then breached with a single query, should that public assurance carry legal or regulatory weight - or is it just marketing language everyone is expected to ignore?
Join the discussion / save / share