Meta has been forced to disable the chat-sharing feature for its Muse AI service after a privacy research team discovered that thousands of shared conversations were publicly accessible. The incident, which came to light this week, exposed sensitive user data including small-business loan applications, partial bank account numbers, employee names, and internal business reports containing personally identifiable information (PII) and raw revenue figures. The root cause was a design decision that embedded the chat title directly into the web address, making it trivial to discover shared conversations through passive DNS queries.
The researchers found that a single DNS query was enough to uncover more than 6,000 shared Muse chats. DNS, or the Domain Name System, is often described as the phonebook of the internet. It translates human-readable domain names into IP addresses. Passive DNS databases collect historical records of these translations, and if a service uses subdomains that include user-generated content—such as a chat title—those subdomains can be enumerated. In Muse's case, the chat title was used as part of the URL, meaning that anyone with access to passive DNS data could potentially discover the shared chats.
The Scale of the Exposure
The exposed conversations were not limited to trivial topics. According to the researchers, the shared chats included a small-business loan application, partial bank account numbers, lists of employee names, and internal business reports riddled with PII and raw revenue figures. This is exactly the kind of sensitive information that users might discuss with an AI assistant while seeking help with financial planning, document drafting, or business analysis. The fact that such data was publicly accessible underscores the risks of sharing AI chats via public links.
Meta responded swiftly after being notified by the researchers. The company yanked Muse's sharing feature, stating that it would make 'changes to how these links can be discovered.' While the feature remains disabled, the incident has raised questions about the security practices of AI chat providers and the inherent vulnerabilities of URL-based sharing.
A Recurring Problem: ChatGPT and Claude
Meta's Muse is not the first AI service to suffer from this type of exposure. Earlier this year, a number of Claude users were shocked to find their shared conversations appearing in Google search results. A similar episode occurred last September, and before that, some ChatGPT users discovered that their shared AI chats were also searchable on Google. In each case, the shared conversations were ultimately removed from search results, but the pattern is clear: public URLs for AI chats are a privacy hazard.
The details of the Meta Muse incident differ from the ChatGPT and Claude cases in one key respect. While the ChatGPT and Claude threads were exposed through Google's web crawler—meaning the URLs were indexed and surfaced in search results—the Muse chats were exposed via DNS queries. However, the underlying vulnerability is the same: the vehicle for sharing these conversations is a publicly accessible URL that can be accessed by anyone who obtains it.
In response to earlier incidents, the major AI providers have taken steps to prevent search engines from crawling shared links. They have also introduced features like Claude's ability to invite specific users to a shared chat, rather than generating a public link for anyone. Meta is expected to implement similar measures. But even with these precautions, shared links remain at the mercy of whomever they are shared with. A link could easily be forwarded via email, posted on social media, or otherwise leaked.
Why Public URLs Are Inherently Risky
The fundamental issue is that a public URL acts as a key. Anyone who possesses the URL can access the content, regardless of whether they were the intended recipient. Unlike a password-protected file or a direct message, a URL does not require authentication. This makes it easy to share, but also easy to leak. For AI chats, which often contain personal or confidential information, the stakes are high.
Moreover, AI chats can be long and contain a wealth of context. A user might share a chat to get feedback on a response, but that chat could include earlier parts of the conversation that the user forgot about—perhaps sensitive details about their health, finances, or work. When you share an entire chat, you share everything in it.
The use of chat titles in URLs, as in the Muse case, adds another layer of risk. If the title is descriptive—for example, 'Small Business Loan Application' or 'Employee Salary Review'—it can reveal the topic of the conversation even before the link is opened. And if the URL structure is predictable, as it was with Muse, automated tools can discover these links without any human intervention.
Best Practices for Users
Given these risks, users should be cautious about sharing AI chats via public links. Here are some recommendations:
- Avoid sharing entire chats. Instead, ask the AI to summarize the pertinent information or to create a PDF that you can share. This way, you control exactly what is shared and can exclude sensitive details.
- Use built-in sharing controls. Some providers now allow you to share chats with specific users, rather than generating a public link. For example, Claude lets you invite specific people to view a chat. Use these features when available.
- Check and unshare. Many AI providers let you see which chats you have already shared and revoke access. Regularly review your shared chats and unshare any that are no longer needed.
- Think before you share. Ask yourself: 'Would I be comfortable pasting this AI chat on the back of a postcard?' If the answer is no, do not share it using a public URL.
The Need for Better Security
The recurring nature of these incidents suggests that AI providers need to rethink their sharing features. Public URLs are convenient, but they are not secure for sensitive content. Providers could implement expiring links, require authentication to view shared chats, or use end-to-end encryption for shared conversations. They could also avoid using user-generated content in URLs and instead use random, non-guessable identifiers.
Meta's decision to disable Muse's sharing feature is a positive step, but it is a reactive one. As AI assistants become more integrated into our daily lives—handling everything from travel planning to financial analysis—the sensitivity of the conversations we have with them will only increase. The industry needs to adopt a security-first approach to sharing, rather than waiting for the next leak.
The incident also serves as a reminder that AI chats are not inherently private. Users should treat them with the same caution they would apply to any other online communication. While AI providers have a responsibility to protect user data, users also play a role in safeguarding their own information. By being mindful of what they share and how they share it, users can reduce the risk of exposure.
As for Meta, the company has not announced when or if the Muse sharing feature will return. In the meantime, users should assume that any chat they have shared via a public link could be accessible to others. If you have shared sensitive information through Muse, it is advisable to review those chats and take appropriate action, such as changing passwords or notifying affected parties if necessary.
Source:PCWorld News