Meta’s Muse Chat Sharing Feature Exposes Chats to Public Search

Muse, Meta’s AI chat app, exploded onto the scene with more than 10.9 million downloads in just 40 days, per Sensor Tower stats reported by TechCrunch. But now, the spotlight’s on a glaring privacy issue. Claroc, a security firm that focuses on AI-related risks, found that Muse chats shared via link could be uncovered by anyone trawling public internet records—even if the sender thought only select people would see them.

The Verge reports Meta has hit pause on Muse’s sharing feature while it sorts this out.

Meta didn’t leave Muse’s growth to chance. They funneled 39% of their October ad budget into the app, aiming to build trust and ramp up users fast. But when you scale this quickly—especially for a tool pitched to both regular folks and businesses—any slip on privacy gets amplified. Sensitive content in the wrong hands is always a risk, but especially so with Muse’s intended audience.

How Muse Sharing Works—and What Went Wrong

Muse lets users turn chat conversations into unique web pages, accessible to anyone with the link—no login walls. That’s a standard play for AI chat apps meant to foster collaboration. But Muse’s approach included both the chat’s title and a random code in the web address. So, if you called a chat "Q3 budget review," the URL would look like q3-budget-review-4d7a19e2—all on a Meta-owned domain.

Each time someone opened a shared Muse chat, their browser did a DNS lookup for the address. Passive DNS services quietly record these lookups, and anyone with access can search and pull up the addresses. That’s how Claroc uncovered over 6,800 Muse share URLs, with clear chat titles that basically indexed the content.

The random part of the URL was supposed to make the links hard to guess, but that didn’t matter—since the whole address, random code included, ended up in public logs as soon as someone visited it.

Claroc’s deep dive showed these URLs weren’t just theoretically exposed—they were actively indexed by passive DNS databases. So, anyone determined (or with the right automation) could hunt down and list shared Muse chats without ever needing the original link. With chat titles right there in the address, it was even easier to spot chats with potentially sensitive material.

Most of what Claroc found was pretty mundane—small business sites, event calendars. But some URLs revealed much more sensitive data:

  • A job candidate’s private notes for a call with a leading AI lab, complete with internal contacts and meeting times
  • An internal revenue review from a marketing firm, flagged for the CEO
  • A small-business loan application disclosing the loan amount
  • A full-year staff vacation schedule listing dozens of employees

This range—from HR notes to strategic business planning—shows that the exposure risk isn’t limited to any one kind of data or company. If your team uses collaborative chat tools, you could be affected.

Claroc flagged the problem to Meta’s bug bounty program on October 8. They didn’t find proof of misuse, and the chats went public only because users shared them. Still, Claroc’s review covered just one DNS service, one type of address, and a specific period. The real scope might be even broader—Claroc found 27 fresh share URLs on their last day of checking, so people were still sharing as scrutiny mounted.

Implications for Businesses and Professionals

This case spells out a hard truth for anyone relying on AI-powered collaboration: just because a link is “unlisted” doesn’t mean it’s private. For businesses, this isn’t a hypothetical risk—Claroc’s findings included confidential internal docs that anyone could stumble upon.

Picture a manager sharing a Muse chat with a draft business plan or a list of upcoming layoffs, assuming only the recipients will see it. If that link is opened just once, its address (and maybe its contents) could end up in a public DNS log, discoverable by anyone with the right tools. That’s a serious worry for companies handling sensitive client data, HR records, or proprietary plans.

The problem is compounded because many users—and even IT pros—don’t know how passive DNS logging works. Unlike your typical web server, where the service provider controls access logs, passive DNS records are kept by third parties and can be searched by anyone with access. So, deleting a Muse chat or revoking a link after the fact doesn’t necessarily solve the problem—the address might still be out there, and someone may have copied the info during the exposure window.

There’s another risk too: putting the chat title in the URL. That’s handy for users but risky if the title gives away what’s being discussed. A competitor or bad actor could scan for titles like "Q3 budget review" or "merger planning"—they wouldn’t even need to open the page to get valuable intel.

Practical Steps to Protect Shared Content

If you or your team use AI chat apps with shareable links, here’s what you should do right now to cut exposure:

  • Don’t share sensitive info using public or unlisted links—especially if there’s no login required.
  • Review your sharing policies for AI and cloud collaboration tools. Make sure employees know the difference between “unlisted” and “private.”
  • Keep an eye out for accidental leaks by searching public DNS records for your own content or using security tools. Security teams should audit for leaks, especially after rolling out new apps.
  • Train employees about the risks of “unlisted” links and why obscurity isn’t real security. Use real examples to drive the point home.
  • Stay on top of vendor updates about security issues or feature changes. Meta has paused Muse’s sharing—watch for future updates or patches.

On top of that, consider putting technical controls in place. For instance, block unauthenticated sharing in business settings, require passwords for shared links, or deploy DLP tools to catch and stop sensitive data from being shared carelessly.

My Perspective: A Cautionary Tale for AI Collaboration

Here’s how I see it: this is a textbook example of how convenience and security pull in opposite directions with modern AI tools. Sharing a chat with a link is great for remote or project-based teams. But as Claroc’s findings show, shortcuts—like stuffing readable chat titles into URLs—can backfire, especially when public infrastructure like DNS logs is in play.

This isn’t just about Muse. Many SaaS and AI platforms use similar sharing models, and most people have no clue how “unlisted” can quickly turn into “public.” The takeaway: if something’s truly sensitive, don’t bank on obscurity or unlisted links. Insist on real privacy features like passwords, expiring links, or access logs.

If you’re shopping for AI tools for your team, prioritize security controls over flashy features or hype.

One more thing: Claroc, the company that surfaced the problem, also sells software to detect risky AI sharing. Their incentive is obvious, but their technical findings are solid and supported by evidence. If you’re a business leader, don’t panic—but do approach every new AI feature with a healthy dose of skepticism, and press vendors for transparency.

Ask not just how a feature works, but how it could fail—and what’s in place to catch or prevent those failures.

If your organization already uses Muse or similar tools, now’s the time to review what’s been shared, check access logs if you have them, and get in touch with vendors about possible exposure. Use this as a reason to revisit how you vet and roll out new AI tools—security and privacy should sit right next to productivity on your checklist.

The Bottom Line

The Muse sharing flaw should be a wake-up call: in the world of AI collaboration, “unlisted” is nowhere near “private.” If you’re sharing anything critical to your business, make sure you know exactly who can see it—and how else it might be found. For now, treat every shareable link as if it’s public, and hold your vendors to a higher security standard. As these AI tools multiply, it’ll take a mix of technology, user training, and vendor accountability to keep sensitive business data actually secure.

For more on Meta Muse, visit https://muse.meta.com/.