Meta has paused a feature that let users share conversations with its Muse artificial-intelligence assistant after security researchers showed that thousands of the resulting links could be found and opened by strangers.
The problem lay in how Meta built the addresses. According to the security firm Claroc, each shared chat was given a web address made from the conversation's title, a short phrase describing what it contained, followed by a random identifier. Those addresses sit under a Meta-owned domain, and the full hostname was written into the public domain name system, the internet's directory of web addresses. A search of historical DNS records therefore returned a list of shared pages, labelled by subject, without anyone having to guess a link.
Claroc said it found more than 6,800 such links. Its researchers opened only a few hundred, so the figure does not mean that 6,800 confidential conversations were exposed. Most of the pages they inspected were ordinary, but a minority held material that users plainly expected to stay private. The examples included a marketing company's internal revenue review addressed to its chief executive, a small business owner's loan application, a workplace's staff calendar for the year, partial details from a bank fraud alert and notes for a job candidate's call with an AI laboratory.
Meta confirmed the pause. "People have the ability to share specific Muse artifacts, which creates a page that can be accessed by those with the link," Tracy Clayton, a spokesperson for Muse, told The Verge. "However, we've paused this functionality while we review this report and consider changes to how these links can be discovered."
The sequence matters. Meta acted once the researchers' findings were reported, and Bangla Tribune said a check of 40 links on 20 October found that none would open. The old DNS records, however, still preserve the hostnames, including the conversation titles, so the subject matter of some shares may remain visible in historical records.
This was a design weakness rather than a break-in. Nobody needed a stolen password or an account to reach the pages; the link itself was the only protection, and the way it was put together made it discoverable. A shared page could be opened by anyone who came across its address, which is why the DNS trail mattered so much.
Muse is part of Meta's artificial-intelligence lineup and was launched only last month. Sharing a conversation is meant to be a convenience, letting a user send a result to a colleague or friend. The episode shows how quickly that convenience can turn into a disclosure when a public link is treated as if it were private.
Similar accidents have happened elsewhere. Shared conversations from OpenAI's ChatGPT, Anthropic's Claude and xAI's Grok have appeared in search results in the past, and security researchers have repeatedly warned that a link created for one recipient may be reachable by anyone who comes across it.
For users, the practical lesson is blunt: a shared AI conversation should be treated as public material. Work documents, loan papers, client names, account numbers, internal calendars and anything else that would cause harm if a stranger read it should not be pasted into a chat that will be shared by link. Where a team relies on such tools, it should check what is being shared and whether the service offers a way to revoke a link after it has been sent.
Several questions remain open. Meta has not said how many shared pages contained sensitive material, whether it has contacted the people affected, how long the links were discoverable, or whether it will restore sharing in a different form. It is also not known how many of the links belonged to users in Bangladesh or elsewhere in South Asia; the researchers did not identify individuals or businesses.
What happens next depends on Meta's review. The company could redesign the share addresses so that titles no longer appear in DNS, add expiry dates, or require a stronger secret before a page opens. Until it says which route it has chosen, the safest assumption for anyone using the assistant is that a Muse share link is not a private channel.


