Meta has paused the conversation-sharing feature in Muse, the personal AI agent app built on the same Muse Spark models as Meta AI. The pause came on October 20, after Ars Technica asked Meta about research published by the security firm Claroc.

What Claroc found

When a Muse user shared a chat, the app created a public page whose web address was built from the conversation's title plus a random ID. Every time someone opened such a page, the full address was looked up in DNS, and commercial passive-DNS services keep a history of those lookups. So the title and the ID, which together work as the key to the page, became searchable.

In a report dated October 18, Claroc says a single passive-DNS search returned more than 6,800 Muse share addresses. Its researchers opened a few hundred of them without logging in, and most loaded. Most were harmless, but a minority contained sensitive material, which Claroc describes only by category: a small-business loan application, a company's internal revenue review, a to-do list with a bank fraud alert and part of an account number, a property investor's performance report, a staff vacation calendar and a candidate's prep notes for a confidential executive-search call.

Claroc says it reported the issue to Meta's bug bounty programme on October 8. It says it has no evidence that anyone misused the pages.

Meta's response

Meta told Ars Technica it had paused the functionality while it reviews the report and considers changes to how links can be discovered. After the pause, Claroc rechecked 40 shares that had previously opened without an account; none opened. The addresses themselves, including the titles, are still in passive-DNS history. Meta has not said when sharing will return or whether old links will work again.

What this means if you use AI chat assistants

Treat a share link as a public page. Anyone who gets or finds the address can open it, and in this case even the title leaked on its own. Don't share chats that contain client data, finances, health or HR details.

Watch the title. If a chat's title describes something private, don't share that chat; copy the useful part into a document you control instead.

Review what you have already shared in any assistant and delete links you no longer need. For teams, Claroc recommends telling staff that shared AI chats become public pages and watching for them as an outbound data transfer.

Comparing assistants for work use? See Meta AI vs ChatGPT.