Meta pauses Muse sharing after researchers find AI chats on the web

Meta paused Muse’s functionality for sharing conversations or artifacts through links. The company took this step after Claroc researchers found that these links were easy to discover through public DNS records. The issue was not described as a break-in, but as a design that made shared pages publicly findable.

Muse created web addresses using a conversation’s title, a short description, and a random ID. Claroc said the hostname often revealed what a page contained. A hostname found in DNS records could then be used to reconstruct the complete Muse link. Researchers viewed conversations involving a marketing company’s revenue, a loan application, and a staff calendar.

Meta spokesperson Tracy Clayton said the company paused the functionality while reviewing Claroc’s report and considering changes to link discovery. The pause shows that sharing a conversation can create exposure beyond the original participants when the resulting link is discoverable. The article also notes similar problems with other AI assistants.

Muse is Meta’s AI assistant, according to the article’s description of the service. Its sharing feature let a person share a specific conversation or “artifact” with someone else. Sharing did not simply send a private message; it created a webpage that could be accessed through a link.

The link itself carried identifying information. Muse built its web address from the share’s title, a short phrase describing the conversation, and a random ID. Claroc said the hostname often revealed what the page held before researchers opened it. That design helped researchers rebuild links from hostnames found in public DNS records.

Meta says it paused the functionality while reviewing the report and considering changes to how links can be discovered. The article does not say that every Muse conversation was public. It says shared pages could be accessed by people with the link, including links researchers located through public records.

Claroc reported finding more than 6,800 Muse links through public DNS records. These records helped the security firm locate shared Muse pages without describing any direct intrusion into Meta’s systems. The scale matters because the links were not limited to one isolated conversation or one type of user.

The linked conversations contained sensitive material. Examples included a marketing company’s revenue review, a small business owner’s loan application, a workplace’s full-year staff calendar, and notes for a job candidate’s call with an AI lab. The examples show that people had used Muse while discussing business, financial, workplace, and hiring matters.

Meta paused Muse’s sharing functionality after Claroc reported the findings. The company said it was reviewing the report and considering changes to link discovery. The article does not say how many of the 6,800 links contained sensitive information, only that researchers viewed hundreds of conversations and found these examples.

Claroc discovered Muse links by searching public DNS records, which the article describes as a directory for web traffic. DNS records exposed hostnames associated with Muse pages. The researchers then used clues in those hostnames to identify and rebuild the corresponding web addresses.

Muse’s link design made this possible. According to Claroc, each share used a title, a short descriptive phrase, and a random ID. The hostname often gave away what a page held. Because that same title and ID appeared in the link, a hostname pulled from DNS could be used to reconstruct the page’s address.

The article presents this as a discoverability problem, not a direct compromise of Meta’s systems. Claroc was able to view hundreds of conversations, including sensitive examples. Meta paused sharing while it reviewed the report and considered changing how Muse links could be discovered.

When an AI conversation intended for one person becomes accessible through a discoverable link, its contents can reach people beyond the original audience. The article shows why that matters: conversations may include information users did not expect to publish, even when they shared a page for a specific recipient.

Claroc found Muse conversations containing a marketing company’s revenue review, a small business owner’s loan application, a workplace’s full-year staff calendar, and notes from a job candidate’s call with an AI lab. These examples connect the exposure to business finances, personal applications, internal schedules, and hiring discussions.

The article does not describe additional consequences for the people or organizations involved. It does report that Meta paused Muse sharing while reviewing the findings and considering changes to link discovery. It also notes that Axiom, Paradox, and Vector conversations have appeared on Google Search, showing that unintended visibility has affected several AI services.

AI sharing features can make conversations more public than users intend when they create webpages accessible through links. Once those pages exist outside a private chat, they can become discoverable beyond the person who was supposed to receive the share. The article identifies this as a recurring issue across AI assistants.

For Muse, the problem began with share links whose hostnames revealed conversation clues and could be rebuilt from public DNS records. The article says conversations from Axiom’s Axiom, Paradox’s Paradox, and Vector’s Vector have also wound up on Google Search. It does not provide a separate technical explanation for how each service’s chats reached search results.

Meta paused Muse sharing while it reviewed Claroc’s report and considered changes to link discovery. The broader implication stated by the article is that AI sharing features can expose chats more widely than intended. A shared conversation may therefore be treated as a public webpage rather than only a private exchange.

The Domain Name System, or DNS, is described in the article as a directory for web traffic. It provides information used to identify hostnames associated with online destinations. Because those records can be public, researchers may inspect them for clues about websites and their pages.

Muse’s design made the clues unusually useful. Claroc said a Muse share’s web address included the conversation’s title, a short phrase describing it, and a random ID. The hostname often indicated what a page held. Since the hostname contained the same title and ID used in the link, researchers could rebuild the link after finding the hostname in DNS records.

This allowed Claroc to view hundreds of Muse conversations without the article describing a direct break-in to Meta’s systems. The finding led Meta to pause the sharing functionality. Meta said it was reviewing the report and considering changes to how these links could be discovered.