Meta Pauses Muse Sharing After Researchers Expose AI Chats

Meta Muse AI chat sharing paused after exposure

Meta pulled the plug on a Muse feature that let people share their AI chats after a security firm found thousands of those links sitting in plain sight on the public internet. The move happened on October 20, 2026, right after researchers at Claroc published a report showing they’d harvested more than 6,800 Muse URLs just by combing through public DNS records. Those records act like a directory for web traffic, and because of how Meta built the sharing links, anyone who knew where to look could reconstruct the full addresses and open the conversations.

This wasn't theoretical. Claroc said they actually viewed hundreds of chats, and the contents read like a privacy nightmare. One conversation held a marketing company's revenue review. Another had a small business owner's loan application. A third revealed a workplace's full-year staff calendar, and a fourth included notes from a job candidate's call with an AI lab. These weren't anonymized snippets. They were real exchanges users had chosen to share with a colleague or friend, believing the link would stay private.

How Muse shareable URLs leaked AI conversations

The root cause was how Muse built its shareable URLs. Each link combined the conversation's title-a short phrase describing the chat-with a random identifier. The hostname itself often gave away the topic before the page even loaded, and because the same title and ID appeared in the DNS entry, pulling that record was enough to rebuild the working link. No brute force, no authentication bypass, just a standard lookup in a system designed to be public.

Meta spokesperson Tracy Clayton confirmed the pause in an emailed statement. She said the company disabled the sharing functionality while it reviews Claroc's findings and considers changes to how these links can be discovered. The statement acknowledged that people can share specific Muse artifacts, which creates a page accessible to anyone with the link, but it didn't address how long the feature had been live in this state or whether Meta had any monitoring in place to detect this kind of enumeration.

AI sharing feature security risks for developers

This incident fits a pattern that should concern anyone building or deploying AI tools with sharing capabilities. OpenAI's ChatGPT, Anthropic's Claude, and xAI's Grok have all seen conversations surface in Google search results after users shared them through similar link-based features. The recurring theme is that developers treat the share link as a capability-something convenient for collaboration-without treating the URL itself as a potential attack surface. When the link structure leaks metadata in DNS or gets indexed by crawlers, the privacy model collapses.

For engineers and product teams, the lesson is clear. Any feature that generates a persistent, guessable, or publicly enumerated URL for sensitive content needs threat modeling that includes DNS exposure, search engine indexing, and link scraping. Short random IDs aren't enough if the surrounding structure-hostnames, path patterns, or title slugs-gives attackers a foothold. Access controls, expiration dates, and opt-in indexing policies should be baked in before the feature ships, not bolted on after a report lands.

What users should know about AI chat privacy

For users, the takeaway is more immediate. Don't put confidential business data, personal identifiers, or financial details into an AI chat that you then share via a link, even if the platform promises privacy. Assume that any shared conversation could become discoverable through mechanisms you can't see or control. If you've used Muse's sharing feature in the past, treat those conversations as potentially exposed and rotate any credentials or sensitive information that appeared in them.

Meta hasn't said when or if the sharing feature will return, nor has it detailed what architectural changes it plans. Until the company publishes a postmortem and a revised design, the safest approach is to keep sensitive work out of shared AI sessions entirely. The industry keeps learning this lesson the hard way. Next time, it could be your data in the DNS logs.

Frequently asked questions

Why did Meta pause the Muse AI chat sharing feature?

Meta disabled Muse sharing on October 20, 2026, after security firm Claroc published a report showing they harvested over 6,800 Muse URLs from public DNS records. The links were publicly discoverable because the sharing URL structure exposed conversation titles and identifiers in DNS entries, allowing anyone to reconstruct working links without authentication.

What types of sensitive information were exposed in the shared Muse chats?

Claroc researchers viewed hundreds of real conversations including a marketing company's revenue review, a small business owner's loan application, a workplace's full-year staff calendar, and notes from a job candidate's call with an AI lab. These were actual exchanges users shared believing the links would remain private.

How did the Muse sharing link structure create a privacy vulnerability?

Each Muse share link combined the conversation title with a random identifier in the hostname and DNS entry. This meant the topic was visible before the page loaded, and the same title and ID appearing in public DNS records allowed researchers to rebuild working links through standard lookups-no brute force or authentication bypass required.

Have other AI platforms experienced similar sharing link privacy issues?

Yes. OpenAI's ChatGPT, Anthropic's Claude, and xAI's Grok have all seen conversations surface in Google search results after users shared them through similar link-based features. The recurring pattern is developers treating share links as collaboration conveniences without treating the URL itself as a potential attack surface.

What should users do if they previously shared sensitive information via Muse links?

Treat those conversations as potentially exposed and rotate any credentials or sensitive information that appeared in them. Don't put confidential business data, personal identifiers, or financial details into AI chats shared via links, even if platforms promise privacy. Assume any shared conversation could become discoverable through mechanisms you can't see or control.

Source: The Verge