AI News
Meta Pauses Muse Chat Sharing After 6,800 Shared Chats Turn Up in Public Records
On October 20, Meta paused the conversation-sharing feature in Muse, its personal AI agent, after security researchers showed that thousands of chats people had shared with one person could in practice be found by anyone. There was no hack, no password breach and no guessing of random links. Researchers at the security firm Claroc ran a single search of public internet records and recovered more than 6,800 Muse share links — listed, in effect, by the conversations' own titles. Meta confirmed the pause in a statement to Ars Technica, which first reported the findings: "we've paused this functionality while we review this report and consider changes to how these links can be discovered."
How a shared link ended up in a public index
When a Muse user shares a conversation, Muse turns it into a web page that anyone holding the link can open — no Meta account required. The page's address was built from the conversation's own title followed by a random identifier, intended to make the link unguessable. The flaw was where that address lived. The title-and-identifier combination formed the page's hostname, and hostnames are resolved through DNS, the internet's address book. DNS lookups are widely recorded by passive DNS services, which keep searchable archives of the names that have been resolved. So the first time anyone opened a shared Muse chat, its full name — readable title included — could be written into those archives.
Claroc summarized the design error in one sentence: "Muse names each share's web address after the conversation's own title, and that address is written into public DNS. One passive-DNS search brings back thousands of them, listed by name, like a table of contents." Muse's robots.txt file asked search engines to stay away from share pages, but that offered no protection: Claroc never used a search engine. The researchers also found more than 75 saved scans of Muse share pages on urlscan.io, a public scanning service. The random part of each address was a secret only until the first person opened the link.
What was actually in the chats
Claroc's researchers opened several hundred of the conversations, and nearly every live share loaded without a login. Most contained routine material. A minority did not. The sample included a small-business loan application, a bank fraud alert showing a transaction amount and partial account details, a marketing company's internal revenue review prepared for its chief executive, confidential notes for an executive-search interview, a workplace vacation calendar listing dozens of employees, and meeting times with a frontier AI lab. These were documents their owners plainly believed they were sending to one person, not publishing.
Two limits on the finding deserve to be stated plainly. Claroc says it found no evidence that anyone misused the exposed shares, and the 6,800 figure counts discovered addresses, not sensitive conversations — most were unremarkable. Claroc also sells software that flags risky AI sharing, so it has a commercial interest in the problem it documented, and its search covered one passive DNS database over a short window in early October. Neither caveat changes the mechanism, which Meta's own response effectively confirmed.
The timeline, and Meta's response
Claroc says it collected the hostnames on October 7 and 8 and reported the issue to Meta's bug bounty program on October 8, with reproduction steps and example shares. It published its research on October 18. After questions from Ars Technica, Meta paused the sharing feature on October 20, saying it was reviewing the report and considering changes to how the links can be discovered. Claroc then rechecked 40 shares it had previously opened and found that none of them would load. The exposure arrived early in Muse's life but not at a small scale: the app passed 10.9 million downloads in its first six weeks, according to Sensor Tower figures reported by Yahoo Finance, so a large number of users had access to the share button.
What it means if you share AI chats
The scope matters. Only conversations that users chose to share were affected; Muse chats that were never shared were not exposed by this flaw. But the episode is a precise demonstration of what a share link is: a publication, not a message. Meta's own help text for shared conversations notes that people with the link can see the conversation and that links do not expire — a model most AI chat products share. And while Meta's pause stopped the pages from loading, the names of already-shared conversations, titles included, remain in passive DNS history.
The practical conclusions are simple. Treat any AI chat you share as public, because technically it is. Delete share links you no longer need. And keep financial documents, personnel material and internal business records out of conversations you might later share — in Muse, and in every other assistant that turns chats into links.