Meta built a share button that published the titles of your AI conversations to a public record. That’s the short version of the Muse mess, and it’s a design failure, not an exotic exploit.
Meta debuted its Muse agentic AI platform last month. Engadget reported that the company has now suspended chat sharing after security firm Claroc showed that anyone could find the shared links. Claroc enumerated 6,800 of them.
Here’s how it worked. Every shared chat got a URL on the same domain, with the conversation’s title as the subdomain. Those hostnames ended up in public DNS. Passive DNS databases log how domain names resolve to IP addresses, basically a phone book for the internet, and they can be searched. No hacking, no stolen credentials. Just a query. Claroc put it bluntly: one passive-DNS search “brings back thousands of them, listed by name, like a table of contents.”
The contents weren’t trivial. Researchers viewed material from both business and personal use, including meeting times with a frontier AI lab, a small-business loan application, a bank fraud alert with partial account details, a company’s vacation calendar and other internal documents. Agentic tools invite exactly this kind of input, because they’re built to handle your real work and real finances.
Meta told Ars Technica, which first covered Claroc’s findings, that it has “paused this functionality while we review this report and consider changes to how these links can be discovered.” Note the wording. Meta is reviewing how links are discovered, not apologizing for creating them. Claroc also said its researchers could no longer open a sample of previously accessed links after the update, which suggests some exposure has been closed. It doesn’t tell us how many people looked before the fix, or whether anyone besides researchers did.
That’s the real question for users. Passive DNS data is collected and resold continuously, so scrapers may already have copies of those hostnames. Titles alone can leak information, and the pages behind them were reachable by anyone with the address. If you shared a Muse chat, assume it was public and think about what was in it.
This also fits a pattern. Shared-chat features from AI vendors have repeatedly turned “unlisted” links into searchable ones, because an unguessable-looking URL is not access control. A link that is secret only by obscurity stops being secret the moment something indexes it. Using a human-readable title as the address made that failure almost automatic.
The fix is not complicated: random tokens, no identifying subdomains, authentication or expiry for shared content. Whether Meta ships that, and says plainly what was exposed and for how long, is what to watch. A paused feature is not an answer.