Meta Muse AI stops sharing feature as corporate leaks exposed

Claroc said it reported the issue to Meta’s bug bounty program on Oct. 8, did not log in or bypass any controls, and has no evidence anyone misused the pages. It withheld every name, title and link from its write-up.

It is not Muse’s first security headline in its six weeks on the market. In late September, Reuters, citing The Information, reported that Meta was adding a clearer safety warning inside the app after an outside researcher found a separate flaw that could have exposed a user’s cloud-based workspace. The app has been popular regardless: Sensor Tower estimated about 2.8 million downloads in its first two weeks, according to Reuters. Mark Zuckerberg had introduced Muse as “built from the ground up for privacy and security.”

Why this lands on HR’s desk

Of the six sensitive pages Claroc described, two sit squarely in HR territory. The vacation calendar is employee data, and it is also a map of when specific people are out of the office, which is useful to anyone attempting fraud or impersonation. Claroc made the same point, warning that lists like this are ready-made for social engineering. That concern overlaps with the growing debate over who owns workforce identity risk, where a recent Entrust survey found just 8 percent of IT and security leaders say HR or the CHRO owns it.

The executive-search notes point to a quieter risk. Candidates, recruiters and hiring managers increasingly use AI to prepare for interviews, and a confidential search is only as confidential as the least careful person in the loop. Claroc noted that while a candidate’s biography might be public, the fact that a particular meeting is happening is not.

None of the exposed content came from a corporate rollout. Muse needs no admin approval, so employees can sign up on their own and connect it to their email and calendars. That is the textbook definition of shadow AI, and HR data is already caught up in it. In Kiteworks’ 2026 Data Security and Compliance Risk survey, 65 percent of organizations said they had discovered employees using unapproved AI tools with sensitive company data. Among those, 31 percent found employee personal and HR data flowing through the tools.