Atlas AI Resources

← Back to AI News

AI privacy

Meta paused Muse chat sharing after researchers found shared chats in public web records

Published October 21, 2026

Meta has switched off sharing in Muse, its new AI agent (an assistant that takes actions for you, not just answers questions), after the security firm Claroc showed that shared conversations could be found and opened by people who were never sent the link. One held a small-business loan application, another a company revenue review, another a candidate’s prep notes for a confidential call. The fix is a pause, and the lesson applies to every chatbot with a share button.

What happened

Muse launched on September 8. When you ask it to share a conversation, it publishes it as a web page and gives you a link that opens without a login. That is by design: it is how the person you send it to gets in.

The trouble was in how the address was built. Claroc found that each share got its own web address made from the conversation’s title plus a random code, like the researchers’ made-up example home-sale-budget-9f21c8a3.cf.metaaiusercontent.com. Nobody could guess the code. Nobody had to.

When a browser visits a web address, it asks the internet’s phone book, called DNS (the Domain Name System), where that address lives. Commercial passive DNS services record those lookups and keep a searchable history. So once the intended recipient opened a Muse share, the full address, title and code included, could land in one of those databases. Claroc says one query returned the list, readable by title.

After filtering out junk, Claroc counted more than 6,800 share addresses and opened a few hundred. Most were harmless. A minority were not. Claroc lists a candidate’s prep notes for a confidential call with a frontier AI lab, a marketing company’s revenue review marked for its CEO, a small-business loan application, a to-do list with a bank fraud alert and a partial account number, and a workplace’s full-year staff vacation calendar.

Claroc says it reported this to Meta’s bug bounty program (where companies take security reports from outside researchers) on October 8. After Ars Technica asked Meta about it, Meta paused sharing on October 20. A Muse spokesperson told The Verge: “we’ve paused this functionality while we review this report and consider changes to how these links can be discovered.” When Claroc rechecked 40 shares that day, none opened.

Why it matters to a normal person

A share link is publishing, not a private message. People treat a long random link as a locked door, but the address itself can leak, and if it describes what is inside, it leaks that too.

It matters more for agents. Ars Technica notes that Muse fills out forms, books appointments and makes purchases, and needs access to most of a user’s accounts. That makes it likelier that its conversations hold real financial and work details.

And it keeps happening. Claroc points out that in 2025, shared ChatGPT conversations showed up in Google results and Google indexed more than 370,000 Grok conversations. Muse did ask search engines to stay away, using a file called robots.txt, but that only asks crawlers not to visit. It locks nothing, and this discovery never touched a search engine. The practical rule, in Claroc’s words: “assume anything you share is public until you have checked.”

What it does not mean

Nobody hacked Muse accounts. Only conversations that a user chose to share were exposed, and private chats were not part of this. Claroc also says it has no evidence anyone misused the pages.

The 6,800 figure counts share addresses, not affected people or sensitive chats. Claroc says its one search method cannot measure Muse’s total exposure or show whether anyone found the pages first.

It is not fully cleaned up, either. The pages stopped opening, but Claroc says the addresses, titles included, still sit in passive DNS history. And Meta has paused sharing, not said how it will change it.

Finally, Claroc sells software that watches for this kind of sharing, so its research also promotes its product. Ars Technica and The Verge reported the findings, and Meta’s statement did not dispute them.

Sources