Meta's new AI companion app, Muse, had a spectacular first month. Launched in September, it reached 10.9 million downloads — 10.2 million of them in the US — within its first 40 days, according to new data from market intelligence firm Sensor Tower, reported by TechCrunch on 20 October 2026. Only 11 other apps in history have ever hit 10 million US downloads that fast.
Days later, the same app was at the centre of a privacy embarrassment. Security researchers at the firm Claroc discovered that more than 6,800 shared Muse conversations could be found through public internet records — no hacking required. Meta has since paused the chat-sharing feature while it reviews the problem.
Two stories, one week, one lesson: apps can grow fast and break trust faster. Here's what happened, what the numbers actually say, and what it means for anyone who uses an AI chatbot.
The download numbers behind the hype
The Sensor Tower figures are genuinely remarkable. Muse became the 12th app ever to cross 10 million US downloads within 40 days of launch — a club dominated by mobile games like Fortnite, PUBG Mobile and Pokémon GO. The only other non-game apps to manage it were Disney+ and Meta's own Threads, back in July 2023.
For context, ChatGPT managed only 3.7 million US downloads in its first 40 days, Grok hit 500,000, and Claude just 200,000. That gap isn't entirely fair — ChatGPT was already a global phenomenon while Muse is available only in the US and Canada — but it shows the power of Meta's distribution machine.
The real engine was money and reach. Sensor Tower estimates Meta devoted 39% of its total US advertising spend to Muse in October, up from 23% in September, pushing it from the 73rd to the 21st-largest US brand by ad impressions in a single month. Cross-promotion across Meta's family of apps, which claims 3.6 billion daily active users, did the rest.
And it isn't just downloads. Muse's 14-day retention in the US was 23%, against an average of 16% for rival AI apps, and 30% after seven days versus 19% for competitors. Daily active users hit 2.5 million on 16 October, up 15% in a week. People aren't just installing it — they're sticking around.
What went wrong: the share links nobody meant to publish
Muse lets users share a conversation by generating a web link — a standard feature in most AI apps. The problem was in how Meta built those links.
According to Claroc, each shared Muse conversation got its own web address made from the conversation's title plus a random ID — for example, something like q3-revenue-review-7b1e42f0 on a Meta content domain. The title part was the fatal flaw: it meant the web address itself often gave away what the page contained before anyone even opened it.
Worse, these web addresses were written into public DNS records. DNS is the system that turns website names into computer addresses — think of it as the internet's phone book. Services called passive-DNS databases keep historical records of those lookups and make them searchable. Claroc simply ran one query against a passive-DNS database and got back thousands of share links, "listed by name, like a table of contents."
Ars Technica notes that the random ID in each URL would normally be too long to guess. The design decision that broke the system was embedding the human-readable title in the web address — which also made every link rebuildable from the DNS record alone. Claroc coined the term "GhostShares" for pages discoverable by people who never received the link.
What the researchers found inside
Claroc says it was able to enumerate 6,800 shared Muse links and viewed hundreds of the conversations. Among the exposed content:
- A marketing company's revenue review
- A small-business loan application
- A bank fraud alert with partial account details
- A workplace's full-year staff calendar
- Notes for a job candidate's call with a frontier AI lab
- Various internal company documents
Its content checks were made on 7 and 8 October. Claroc said it had no evidence anyone had misused the shares — but the point stands: this material was never meant to be on the public internet.
This isn't the first time AI sharing features have been more public than intended. Conversations with ChatGPT, Claude, and Grok have previously ended up in Google Search results. The pattern keeps repeating because the "share" button feels private even when the link it produces is anything but.
Meta's response
Meta's reaction was swift. Spokesperson Tracy Clayton told The Verge: "People have the ability to share specific Muse artifacts, which creates a page that can be accessed by those with the link. However, we've paused this functionality while we review this report and consider changes to how these links can be discovered."
Claroc confirmed that after Meta's update, its researchers could no longer open a sampling of the links they had previously accessed.
There's a certain irony here. As Ars Technica pointed out, Meta CEO Mark Zuckerberg had described Muse as "built from the ground up for privacy and security." The share-link design suggests that message didn't reach every corner of the engineering process.
What should you actually share in an AI chat?
This story is a good excuse to review your own habits. The rule of thumb is simple: if you wouldn't email it to a stranger, don't paste it into an AI chatbot — and especially don't hit "share" on it.
| ✅ Generally safe to share | 🚫 Never share |
|---|---|
| General knowledge questions | Passwords or login credentials |
| Drafting help with non-sensitive text | Bank account or card details |
| Coding questions on public code | Loan, tax, or financial applications |
| Study notes and explanations | Full names, addresses, ID numbers |
| Creative writing and brainstorming | Internal company documents |
| Publicly available data analysis | Medical records or health details |
A few practical habits help even more:
- Treat every "share" link as public. If the app gives you a URL, assume anyone could find it.
- Rename before you share. Many AI apps name the share link after your chat title — a title like "Q3 revenue review" broadcasts the content. If you can edit the title, make it generic.
- Check app settings for training opt-outs. Many AI apps use your chats to train future models by default; the setting to turn that off is usually buried in privacy settings.
- Turn on two-factor authentication on your AI accounts, so a leaked link can't be parlayed into account access. And if you're still reusing passwords, passkeys are a safer upgrade worth reading about.
- For sensitive research on public networks, a VPN keeps your traffic private between you and the app — though it wouldn't have prevented this particular leak, which was a server-side design flaw.
The wider picture: Muse is growing up fast
The leak landed in an already dramatic month for Meta's AI push. Two other developments show how fast the company is moving — and where the friction is:
The open model. On 15 October, Meta released Muse Spark Open, an open-weight AI model with 816 billion total parameters (42 billion active per token) and a one-million-token context window. Notably, Meta partnered with Apple to optimise it for Apple Silicon, demonstrating it running locally across two M5 Ultra Mac Studios with 512GB of unified memory each. Zuckerberg confirmed the collaboration publicly — though it stops well short of putting Muse into Siri or Apple Intelligence. It's a developer-and-researcher tool, not a consumer app: you need roughly a terabyte of memory to run it yourself.
The training-terms controversy. Also in October, Meta updated its commercial terms for businesses using its platforms, in language that publishers feared could let it scrape news websites — including journalism — to train AI models for free. The story was first flagged by Nieman Lab and reported by The Verge; the News/Media Alliance's Danielle Coffey called the terms "outrageous and probably illegal." Facing the backlash, Meta removed the word "train" from the disputed language before the terms' 30 October effective date — while insisting the crawling terms only ever applied to ads and business products.
Fast growth, fast corrections. Meta is learning in public.
Takeaway Checklist
- Muse is a genuine hit: 10.2 million US downloads in 40 days (Sensor Tower), 23% two-week retention, 2.5 million daily active users on 16 October — ahead of ChatGPT's early pace, powered by Meta's ad spending and its 3.6 billion daily users.
- The share feature was the weak link: 6,800+ shared chats were discoverable through public DNS records because URLs contained the conversation's title. Meta has paused the feature.
- If you shared a Muse chat, treat that link as public. Meta blocked access after the report, but the exposure already happened.
- Never paste sensitive material into any AI chatbot — financial, medical, company-internal, or personal identity details.
- Rename shares, check privacy settings, and use 2FA on every AI account you use.
- Watch the pattern, not just the app: share links have leaked from ChatGPT, Claude and Grok too. The "share" button is the riskiest button in every AI app.
