Meta has stopped letting users share Muse conversations through public links after a security firm found that the pages could be located on the open web. The company confirmed the pause in a statement to The Verge. Muse spokesperson Tracy Clayton said people can share specific Muse artifacts, which produces a page accessible to anyone with the link. Clayton said Meta has paused that functionality while it reviews the report and considers changes to how the links can be discovered.
The feature at the center of the pause lets a user send a Muse conversation to someone else by link. Claroc, the security firm that flagged the issue, said Meta's design made those links easy to find. According to Claroc, Muse constructs each share's web address from the share's title, a short phrase describing the conversation, followed by a random ID.
Claroc said the hostname usually revealed what a page contained before it was opened. Because the link carries the same title and ID, a hostname pulled from DNS is enough to rebuild the link, according to the firm. Searching public DNS records, which act as a directory for web traffic, allowed Claroc to view hundreds of Muse conversations.
The exposed pages included a marketing company's revenue review, a small business owner's loan application and a workplace's full-year staff calendar, Claroc found. The firm also reported seeing notes for a job candidate's call with an AI lab. The findings mean some Muse users shared links with a limited audience but had their conversations surfaced to anyone who could reconstruct the address.
The incident is not the first time an AI sharing feature has put conversations in front of a wider audience than users intended. Conversations with OpenAI's ChatGPT, Anthropic's Claude and xAI's Grok have wound up on Google Search, according to the report. Meta has not said how long the review will take or what changes it might make to link discovery.
More AI news from TechManNews.
