Meta pauses Muse sharing after researchers find AI chats on the web

THE NEWS

What happened

Meta has temporarily disabled the ability to share conversations with its Muse AI assistant after security researchers discovered that thousands of these links were publicly accessible via DNS records. The flaw exposed sensitive data including financial documents, calendars, and personal notes from various organizations.

CONTEXT

Why it matters

Meta has temporarily disabled the 'share' feature for its Muse AI assistant. Security researchers from Claroc discovered that over 6,800 conversation links were publicly available through public DNS records. These accessible chats contained sensitive information including a marketing firm's revenue data, a small business loan application, and full-year staff calendars. The issue arose because the shareable URLs included descriptive titles that made them easy to reconstruct from DNS data. This is not an isolated incident; similar privacy flaws have previously affected sharing features in ChatGPT, Claude, and Grok. Meta states it is reviewing how these links are discovered while implementing changes to prevent future leaks.

AT A GLANCE

Key facts

• Meta paused the Muse sharing feature following a report by security firm Claroc.
• Researchers found over 6,800 public Muse links using standard DNS record searches.
• Exposed data included marketing revenue reports, loan applications, and staff calendars.
• The vulnerability stemmed from how shareable URLs were constructed using conversation titles.
• This incident mirrors previous privacy issues with ChatGPT, Claude, and Grok sharing features.