Meta shipped a sharing feature that published private chats to a searchable public index, and it took researchers about a month to notice. That’s the short version of what happened with Muse, the company’s new agentic AI platform.
According to Engadget, security firm Claroc found that every Muse share link used the same domain and put the conversation’s title in the subdomain. Those subdomains landed in public DNS records. A passive DNS search, which works like a phone book for domain lookups, returned thousands of them. Claroc described the result as a table of contents. Its researchers enumerated 6,800 shared chats.
What they could read was not trivial. The exposed material included a small-business loan application, a bank fraud alert with partial account details, meeting times with a frontier AI lab, a company vacation calendar and internal business documents. Both personal and work use showed up, which suggests people treated Muse as a general-purpose assistant and assumed a share link was effectively private.
Meta paused the feature. In a statement to Ars Technica, which first reported the findings, the company said it is reviewing the report and considering changes to how links can be discovered. Claroc also said it could no longer open a sample of links it had accessed before.
The design flaw is the interesting part. This isn’t a model failure or a prompt injection trick. It’s a plain web architecture mistake: putting human-readable, guessable data in a hostname. Anything in a hostname can leak through DNS records and certificate logs. Random, unguessable path tokens behind a login or an expiring link would have avoided it.
We’ve seen versions of this before. OpenAI removed its opt-in feature that let ChatGPT shared chats appear in search engines after users found personal conversations indexed. Google’s Bard shared links also turned up in search results in 2023. The pattern is consistent: AI vendors race to add social features, and the privacy review lags behind.
So does this matter? For Meta, yes, mostly for trust. Muse is pitched as an agent, meaning it may handle more sensitive context than a chatbot, such as calendars, finances and company files. Sharing that output carelessly is a bigger risk than sharing a recipe.
For developers and founders evaluating agent platforms, the takeaway is practical. Ask how share links are generated, whether they can be revoked, and whether they are indexable. Until Meta says how it will fix this, treat anything you’ve put into Muse as potentially exposed if you ever used the sharing option.
