Meta pauses Muse chat sharing after 6,800 private conversations exposed

Meta disabled Muse chat sharing after Claroc found URL subdomains based on titles were discoverable via passive DNS, exposing business and personal details. Operators should review how they share AI conversations.

What happened

Meta debuted its Muse agentic AI platform last month and has now paused the feature that let users share Muse conversations by creating a URL. The change came after researchers at security firm Claroc found that anyone could potentially access those shared links.

According to Engadget, Claroc discovered that shared Muse chat URLs all used the same domain name and placed the conversation's title in the subdomain. Because those addresses were written into public DNS, a passive DNS search could enumerate them. Claroc said researchers were able to enumerate 6,800 links for shared Muse chats and view private information from both business and personal applications of the service.

Meta told Ars Technica:

"we've paused this functionality while we review this report and consider changes to how these links can be discovered."

Key facts

• Researchers at security firm Claroc enumerated 6,800 links for shared Muse chats.
• Shared Muse chat URLs used the same domain name and the conversation's title in the subdomain.
• Exposed personal and business details included meeting times with a frontier AI lab, a small-business loan application, a bank fraud alert with partial account details, and a company's vacation calendar.
• Meta said it paused the sharing functionality while reviewing the report and considering changes to link discovery.
• Claroc researchers could no longer open a sampling of previously accessed links after Meta's update.

Our analysis

The issue is not a conventional breach; it is a discoverability problem created by predictable URL design. By naming each share's web address after the conversation title and using a shared domain, Meta likely made link enumeration straightforward for anyone who knew how to query passive DNS records.

This matters for social media managers, creators and community operators because AI conversation titles are often treated as casual notes, not as public metadata. A title such as "client loan application" or "bank alert follow-up" becomes the subdomain, which suggests that even a non-sensitive body can expose context through the title alone. The presence of internal company documents among the 6,800 enumerated links also indicates that personal and business use blended in ways users may not have expected to become discoverable.

The fact that Meta paused the feature quickly and Claroc could no longer access a sampling of links after the update suggests the platform is treating this as a serious privacy control issue, but the exposure window may still matter for anyone who shared links before the pause.

What it means for operators

• Avoid sensitive titles in AI chat shares. Use generic names because the conversation title may become part of a discoverable URL; do not include client names, meeting times, loan, bank or HR details.
• Audit existing shared AI links. If your team used Muse or similar tools, check whether any shared URLs are still live and remove or replace them where possible.
• Update team guidance for AI tools. Treat conversation titles and URLs as potentially public metadata, not just internal notes, and add this to your social media or content workflow checklist.
• Watch for platform changes before relying on sharing. Meta's statement says the functionality is paused while it considers changes to how links can be discovered, so wait for a confirmed fix before including shared links in client deliverables.