People who shared Meta Muse conversations through web links may have made sensitive content discoverable beyond the intended recipients. Researchers enumerated 6,800 share links and found apparently private information after reviewing several hundred. Conversation titles were placed in subdomains, where passive DNS services could record and expose them to searches. Meta paused the sharing feature while reviewing the report and possible changes.
Why It Matters
Muse can access accounts and perform tasks such as completing forms, booking appointments and creating documents, increasing the sensitivity of its conversations. A long random string did not provide effective secrecy because another part of the address exposed discoverable information. For leaders: public-link design needs threat modeling across DNS and other supporting systems. For defenders: review prior AI sharing practices and treat anyone-with-the-link pages as public. The broader lesson is that privacy can fail through metadata even when content URLs appear difficult to guess.
What Defenders Should Do
Review previously shared Muse conversations and avoid placing sensitive information in public-link workflows.