Sharing an AI conversation with one colleague should not make it accessible to strangers.
Security firm Claroc found more than 6,800 discoverable addresses for user-created public shares from Meta’s Muse AI assistant. Some of the conversations it inspected contained confidential business records and sensitive personal information.
For IT teams, the exposure shows why approving an AI assistant also requires checking its sharing features: employees may be able to publish company information beyond the intended recipient.
Chat titles surfaced in internet records
When a user shared a Muse conversation, the assistant created a public webpage with the conversation’s title and a random identifier in its hostname. In its GhostShares investigation, security firm Claroc traced these addresses to cf.metaaiusercontent.com, the domain hosting the pages.
Researchers searched a commercial passive-DNS database, which records observed domain lookups. One query returned thousands of share hostnames containing readable titles and their random identifiers. Sampled pages opened without signing in. Instructions discouraging search-engine crawling did not prevent this DNS-based discovery.
Among the accessible material were a CEO-only company revenue review and confidential notes prepared for an executive-search meeting with a major AI laboratory. Other examples included a small-business loan application, a bank fraud alert containing partial account information and an employee vacation calendar.
Most of the few hundred conversations Claroc reviewed were harmless. Still, the sensitive records exposed through an ordinary sharing command illustrate why AI governance must cover employees’ actions within approved tools.
Meta suspends sharing after researchers report the exposure
Claroc submitted its findings through Meta's bug bounty program on Oct. 8, providing sample links and instructions for reproducing the discovery. Its research became public on Oct. 18.
On Oct. 20, the company suspended Muse's conversation-sharing feature. Spokesperson Tracy Clayton confirmed to The Verge that Meta was reviewing the report and considering changes to how people could discover shared links.
Following the suspension, Claroc retested 40 previously accessible pages and found that none would open. Conversation titles remained visible in historical DNS records. Meta has not announced when sharing will resume or detailed a permanent remedy, and Claroc said it had no evidence that anyone had misused the shares.
What eWeek found: Chat-sharing privacy risks predated Muse’s launch
Before Muse launched, shared conversations from ChatGPT, Grok, and Claude had surfaced in search results. eWeek compared these earlier incidents with official documentation to examine how the platforms currently handle sharing and what protections businesses can use.
AI assistant | Earlier exposure | Response and current sharing controls |
|---|---|---|
| Meta Muse | Public conversation links were discovered through DNS records. | Sharing suspended Oct. 20. |
| ChatGPT | Shared conversations appeared in Google searches. | OpenAI removed the search-discoverability option. Business links stay inside the workspace, while Enterprise admins can disable sharing. |
| Claude | Shared chats and Artifacts surfaced in search results. | Email-specific invitations are now the default. Team and Enterprise sharing stays within the organization, and administrators can disable it. |
| Grok | Publicly shared conversations were indexed by search engines. | Users can revoke public links. Grok Business administrators can restrict the sharing audience or disable the feature. |
Previous incidents had already demonstrated the risks of public AI conversation links. Muse’s exposure involved DNS discovery rather than search-engine indexing, but the practical consequence was similar: sensitive information became accessible beyond its intended audience.
The comparison highlights two separate questions for businesses: how easily can someone discover a shared conversation, and what permission do they need to read it? Discouraging search-engine crawling addresses neither authentication nor recipient authorization. Workspace membership checks or invitations tied to specific accounts can restrict access even when a link becomes public.
Account type matters, too. Business sharing controls do not necessarily protect employees using personal accounts. Teams should verify which accounts staff use and test whether their organization’s restrictions cover the conversations being shared.
AI companies introducing sharing features should examine those earlier failures and test their own access restrictions before release. Suspending Muse sharing was an appropriate immediate response. Its eventual return will provide a test of how effectively the company has addressed the exposure.
Users and businesses can take several precautions:
- Review previously shared Muse conversations and report any confidential information exposure.
- Replace exposed credentials and assess potential notification obligations involving personal records.
- Check sharing permissions and administrative controls before using AI assistants for confidential work.
As businesses entrust more sensitive information to AI assistants, vendors will face greater expectations to demonstrate that privacy protections have been tested before deployment.
More AI news: Microsoft wants enterprises to treat AI agents like insiders, with permissions that can change or disappear when their behavior becomes risky.