Security flaw in Meta Muse exposes thousands of private chats and sensitive business data
The convenience of a single "share" button in an AI interface often masks a significant security vulnerability. For users of Meta's Muse, that convenience recently turned into a data leak involving thousands of private conversations.
The breach was uncovered by privacy researchers at Claroc, who discovered that a single DNS query could expose more than 6,000 shared Muse chats. The leaked data was not merely casual conversation; the researchers found highly sensitive information, including:
- Small-business loan applications
- Partial bank account numbers
- Internal business reports containing raw revenue figures
- Lists of employee names and other personally identifiable information (PII)
This exposure was not the result of a rogue AI agent or a traditional hack, but rather a fundamental flaw in how Meta structured its sharing links. By including the title of the chat directly within the web address, Meta made it possible for these conversations to be discovered via a passive DNS search. Upon being notified of the vulnerability, Meta disabled the sharing feature in Muse while it works on changing how those links are discovered.
A Pattern of Public URLs
The incident with Muse is part of a broader, recurring problem across the AI industry. While the technical mechanism in Meta's case involved DNS queries, other major providers have faced similar issues where shared chats were indexed by search engines. Both ChatGPT and Claude users have previously discovered their shared conversations appearing in Google search results, though those specific threads were eventually removed.
Despite the different methods of discovery—DNS queries for Meta versus web crawling for OpenAI and Anthropic—the root cause remains the same. The primary vehicle for sharing sessions across ChatGPT, Claude, Gemini, and Meta is a publicly accessible URL. Essentially, anyone who obtains the link can view the contents of the chat.
To combat this, AI providers have implemented various safeguards. Some have taken steps to prevent search bots from crawling shared links, while the Claude app has introduced the ability to invite specific users to a thread rather than generating a generic public link. Meta is expected to implement similar discovery protections for Muse.
The Risks of Permanent Links
Even with protections against search engines and DNS sniffing, the inherent nature of a public URL remains a risk. Once a link is generated and shared, it is subject to the discretion of the recipient, who could easily forward the URL via email or post it on social media.
To avoid these pitfalls, users are encouraged to move away from sharing entire chat histories. Instead, asking the AI to summarize only the necessary information or exporting the data as a PDF provides a more secure alternative. Most major AI providers also offer a way for users to review which chats they have previously shared and revoke access to those links.
The overarching lesson is that a public URL is rarely a secure vault. A useful rule of thumb for any AI user is to consider whether they would be comfortable pasting the contents of a chat on the back of a postcard; if the answer is no, the session should not be shared via a public link.
