Meta pauses Muse sharing after researchers find AI chats on the web

Meta has paused the feature that lets people share Muse conversations by link after the security firm Claroc reported finding more than 6,800 of those links through public DNS records. Claroc says it could open hundreds of shared conversations, including a marketing company's revenue review, a small business owner's loan application, a workplace's full-year staff calendar, and a job candidate's notes for a call with an AI lab.

A Muse spokesperson, Tracy Clayton, told The Verge that Meta paused the function while it reviews the report and considers how the links can be discovered. For anyone treating an assistant as a workspace, this is a reminder that a private-feeling chat can become a public page with one tap.

The mechanics are what make this frustrating. According to Claroc, Muse built each shared page's web address from the conversation's title, then a random ID. The hostname often revealed what a page contained before anyone opened it, and because the link carried that same title and ID, pulling the hostname from DNS was enough to rebuild the link. A random ID is supposed to make a link unguessable. Putting it in a place that gets recorded publicly undoes that protection.

We don't think the sharing feature itself is the problem. Sharing a useful chat with a colleague is a reasonable thing to want. The failure is treating a share link as private while publishing the clues to find it. That is a design review miss, and it's the kind that a company deploying an assistant to a huge user base should catch before launch, not after outside researchers do.

It's also not new, which is the part that should worry us most. The Verge notes ChatGPT, Claude and Grok conversations have each ended up in Google Search at various points. The industry keeps relearning the same lesson: people put their business plans, finances and personal lives into these chats, and every sharing pathway needs to be designed as if the content were sensitive, because it usually is.

For Muse specifically, this lands on top of other recent trouble, including a separately reported security flaw Meta says it fixed. Muse is meant to be an assistant that does work for people. Trust in that kind of product is built on boring defaults: unguessable links that stay unguessable, clear warnings about what becomes visible, and easy ways to revoke access. I'm watching whether Meta's fix covers the links already exposed, not just future ones.

Where this leads if it scales: as assistants handle more real work, chat leaks stop being embarrassing and start being material, with financial data, hiring information and internal schedules in play. That raises the bar for every lab shipping share features.

Claroc published its findings in a report this week, and Ars Technica first reported the exposure. Public DNS records act as a directory of web hostnames, and services that create unique hostnames for shared content can inadvertently list them there.