Meta Muse shared chats could be found by anyone holding a link, and Meta has paused the sharing feature while it investigates. Security researchers counted about 6,800 public links, and some of the pages held business records and personal financial details. Benzinga reported the pause.
The problem surfaced through a report from Claroc, a security firm. Meta has said that shared Muse content becomes a webpage that anyone with the link can open. In practice, a share button turned private conversations into public pages, and the company paused the feature while it looks into how that happened.
Muse is a Meta AI product that is distinct from Meta's Muse Spark model, and the two names should not be confused. The reporting describes a sharing-link design problem, not a model-training issue. For anyone who uses Muse for personal or work chats, the practical question is what happened to the chats they chose to share.
How Meta Muse shared chats became searchable
According to Claroc, Muse named each share page after the conversation's title and placed that title in the web address under cf.metaaiusercontent.com, a domain linked to Meta. The firm summed up the risk in a blog post, quoted by IBTimes: "Muse names each share's web address after the conversation's own title, and that address is written into public DNS."
DNS translates web addresses into server locations, and every lookup leaves a record. Passive DNS services collect those records over time, which lets a researcher search for hostnames that appeared in past lookups. The researchers argued that an "unlisted" link can still be discovered this way, according to The Neuron Daily.
Passive DNS is a commercial and research tool, not a hacking tool. The method did not require breaking into Muse, and that detail is the heart of the problem. A link that is hard to guess can still be exposed if its address sits in logs that outside services keep.
Claroc also found more than 75 saved scans of Muse share pages on urlscan.io, a URL scanning service, as Cybersecurity News reported. Those saved scans offer a second route to the content.
The count itself varies by source. One report describes 6,800-plus links, while another counts 6,800 share hostnames after filtering out wildcard DNS noise. Either way, the number runs into the thousands, and Claroc says it accessed hundreds of conversations.
What the exposed conversations included
IBTimes reported that the exposed material included meeting details involving a leading AI lab, a small-business loan application, a bank fraud alert with partial account information, a company vacation calendar and internal business documents. Those examples show how mixed the risk was. Some pages were personal, and others were the kind of paperwork a company would never post publicly.
The reporting also sets a clear limit. Only pages users chose to share were affected, not every private Muse conversation. Anyone who held an affected link could open its contents without signing in.
Small businesses face the most exposure. Owners and staff often paste loan files and internal documents into a chat to get quick help. A chat window feels like a private workspace, but a share link turns it into a page with an address, and that address can outlive the user's intent.
Based on the reporting, the categories at risk include:
- Personal, medical, legal or financial details in any chat a user shared
- Partial account details, such as those in the bank fraud alert described in the reporting
- Internal business files, loan paperwork and company calendars
Which Muse users should check their chats now
Meta has not said which share links were affected. Until the company does, treat every shared Muse chat as potentially reachable.
- Open Muse and list every chat you have shared. Flag any that contain medical, legal, financial or business information.
- Stop creating new share links while the feature is paused.
- Open each shared link in a private browser window while signed out. If it loads without a login, anyone with the URL can read it.
- If a shared chat included account numbers or a fraud alert, contact your bank and ask about monitoring or a new account number.
- Keep account numbers, loan paperwork, medical details and internal business files out of any AI chat's share function, not only Muse's.
- Watch for a notice from Meta about affected users.
Deleting a shared chat may not erase copies that outside services already saved. The urlscan.io captures are a good example, because Muse does not control them. Anyone who could reach a chat before it was removed should be treated as someone who may have seen it.
Meta's earlier AI privacy problems
This is not the first time Meta has faced questions about AI chats that users assumed were private. In 2025, The Washington Post reported that Meta's AI chatbot was divulging users' most private searches. The Meta AI app's Discover feed showed conversations that many users did not realize were public.
Meta later added a warning that prompts posted to the feed are public, as Mashable reported via Yahoo. That warning would not have prevented the Muse exposure. The earlier problem involved a visibility setting that users could misread. The Muse flaw works differently, because predictable web addresses and public DNS logs expose pages that users shared on purpose.
The timing adds pressure. CNBC reported that Meta raised its capital expenditure forecast in its latest earnings report, which reignited concerns about AI spending. As USA 24 reported in its coverage of the AI stock selloff, investors have been quick to react to AI news. A privacy lapse in a consumer AI product gives critics another point to raise at a moment when Meta is spending heavily.
State officials have also scrutinized Meta's AI products. Rhode Island has sued Meta over scam ads and its AI ad tools, which shows that the company's AI features already draw attention beyond Silicon Valley. The Muse case will add to that record if regulators ask for details.
What to watch as Meta restores sharing
Several questions remain open. The sources do not say how many users were affected, or how many links third parties actually accessed rather than merely found. Nothing in the reporting shows that the flaw was exploited before researchers reported it.
Meta has not given a timeline for restoring sharing, and it has not described the fix. A Meta spokesperson told Benzinga that the company launched a Muse bug bounty program so researchers can look for potential issues. That program may surface more details about the scope of the flaw.
One claim also remains unverified. In September, Inc. columnist Jason Aten alleged that Muse accessed private messages on his Mac even though he never enabled the Full Disk Access permission. That is an individual allegation, and the reporting does not confirm it. Whether Meta will notify users or report the incident to regulators has not been confirmed either.
The next signals will come from Meta's fix and from any notice the company sends to users. If Meta restores sharing, the new design should show whether title-based addresses are gone for good. Until then, treat any shared Muse chat as public.
