Meta Pauses Muse Sharing After Chat Links Surface

Meta paused Muse’s conversation-sharing feature after researchers found that share links could be discovered through records of internet lookups. People had chosen to create those links, but the way Muse named them let someone search for links without receiving them from the person who shared the conversation.

Security firm Claroc found thousands of share addresses and opened some pages containing personal and business information. Meta told Ars Technica that a shared Muse artifact created a page accessible to anyone with its link, and that the company had paused sharing while it reviewed how the links could be discovered. The affected feature was sharing: this finding does not mean every conversation someone had with Muse was exposed.

The useful question for anyone who has clicked an AI assistant’s Share button is what that button actually grants. A link can be difficult for a stranger to guess and still work for anyone who obtains it. Muse added a second problem: its link design gave strangers a way to find addresses that users had not sent them.

How an Address Became a Directory

A Muse share address combined a readable conversation title and a random-looking identifier in a hostname under cf.metaaiusercontent.com. A hostname is the portion of a web address that the domain name system, or DNS, looks up to connect a browser to a server. In Muse’s design, both the title and identifier sat in that DNS-visible portion, rather than leaving the identifying text solely in a URL path.

Passive-DNS services collect some observed DNS responses and preserve the hostnames in searchable historical records. Claroc searched those records for Muse’s shared domain, then used the resulting hostnames to find share pages. The search saved researchers from having to guess each identifier. It also put conversation titles in a list they could scan for potentially sensitive subjects. Participating collection points had recorded enough Muse hostnames for Claroc’s search to work.

Consider the difference between trying random keys in a lock and finding a list of keys written on a noticeboard. The long identifier can make blind guessing impractical. Once a service has recorded the complete hostname, guessing is no longer the task. The title made the list easier to navigate, while the recorded identifier supplied the address needed to open a page. Claroc’s route required no stolen Muse account, password guessing or software exploit.

Claroc counted more than 6,800 share hostnames after filtering unrelated DNS results. Researchers opened only a few hundred pages; most of those were ordinary material, while a minority contained sensitive information. The 6,800 figure counts discovered hostnames, not confirmed sensitive conversations or people harmed. Claroc said it found no evidence of misuse by others, although its search and page checks cannot tell us whether someone else previously visited a link.

Among the pages Claroc opened were an internal revenue review marked for a company CEO, a small-business loan application and a bank fraud alert containing partial account details. Researchers also found notes for a confidential executive-search call that included a contact and meeting time. A person with those details might attempt a targeted impersonation; the discovery itself is not evidence that one happened. Claroc withheld names and links, and did not contact the people involved to ask whether they had intended the material to be accessible so widely.

The Earlier Warning, and a Different Route In

Long before this week’s pause, security discussions about AI chat sharing had identified a basic trade-off. An August Breachroad analysis of public chat links explained that a long, hard-to-guess address can reduce blind enumeration, while copies of that address may travel through search indexes, browser history, messages or archives. The link is convenient precisely because a recipient can open it without an account-specific invitation. That convenience gives the sender less control over where the address goes next.

Earlier exposure involving ChatGPT shared conversations used search-engine indexing as a discovery route. Muse’s reported route was DNS history. Those are different mechanisms: a crawler may list a page in search results, while a passive-DNS record can reveal a hostname that a participating service observed during a lookup. Muse’s robots.txt asked search and AI crawlers to avoid share paths, but that instruction could neither stop DNS collection nor prevent a person holding a working link from opening a page. The earlier case helps explain why crawler settings come up in this discussion; it cannot tell us how many Muse pages outsiders found or how another assistant currently builds its links.

A product can address one route without closing the other. Keeping a long identifier out of an easily searchable hostname would address the route Claroc used. Asking crawlers to stay away can reduce some search indexing. Neither measure, on its own, makes a page available only to named recipients. That would require an access check, with the corresponding inconvenience of requiring recipients to authenticate or receive permission.

Meta’s position also deserves its strongest reading. Sharing was an action users took, and Meta described the resulting pages as accessible to people with the link. It has paused the feature rather than leaving the reported discovery route open while it considers changes. Someone who deliberately shares a harmless artifact may prefer the speed of a link over an invitation system. The design problem is that a person making that choice may expect the address to travel only to the recipient; Muse’s title-bearing hostname created a searchable route beyond that hand-off.

What the Pause Changes

After Meta’s change, Claroc could no longer open a sample of links it had previously accessed. In a more specific recheck on October 20, Claroc tried 40 formerly accessible shares; none opened, while historical DNS records still retained hostnames and titles. Blocking a page can stop a fresh visitor from reading its contents through that link. It cannot remove a title already preserved in a historical record.

If you shared a Muse conversation, think about the whole page you shared, including material the assistant pulled into its answer. A copied excerpt sent through a recipient-restricted channel avoids publishing the full share page, though it takes more effort. If a page included account credentials or other secrets, removing access to the page would leave any previously copied secret usable; handle that secret through the relevant account or workplace process.

Organizations have a different job from asking employees to be careful. Breachroad recommends keeping track of which assistants permit public sharing, logging creation of public links where managed tools allow it, and offering authenticated recipients, expiry and revocation for sensitive work. A company deciding whether to permit link sharing can weigh the collaboration benefit against the possibility that an address escapes its intended channel. For people using personal accounts, an employer may have less visibility into what was shared, which makes a clear route for reporting a mistaken share more useful than a blanket instruction to be cautious.

Muse’s pause closes access to pages in Claroc’s checked sample. The longer-term test for any replacement sharing feature is simpler to phrase than to implement: when a user sends a conversation to one person, who else can find its address, and who can open it?