Meta pauses Muse AI chat-sharing after researchers found 6,800 shared conversations discoverable online

Meta has paused the chat-sharing feature in Muse after security firm Claroc found roughly 6,800 shared conversation links discoverable online — a finding Ars Technica first reported.

The cause was the link design: Muse built each share link with the conversation’s title in the URL hostname, under cf.metaaiusercontent.com, and those hostnames landed in public passive-DNS records. One Claroc search returned thousands, “listed by name, like a table of contents”.

The links held sensitive material. Engadget reports the examined chats included meeting times with a frontier AI lab, a small-business loan application, a bank fraud alert with partial account details, a company vacation calendar and internal company documents. The Verge’s list adds a marketing company’s revenue review, a workplace’s full-year staff calendar and notes for a candidate’s call with an AI lab.

Meta pulled the feature. Muse spokesperson Tracy Clayton told The Verge: “we’ve paused this functionality while we review this report and consider changes to how these links can be discovered.” Asaf Aprozper, Claroc’s co-founder and CTO, filed the findings via Meta’s bug bounty programme on 8 October, after examining the pages on 7–8 October; after the fix, Claroc could no longer open a sample of the links it had previously accessed.

Only conversations users had chosen to share were affected — unshared private chats were not. An early black eye for Muse, the agentic AI platform Meta launched in September 2026.

Sources: Ars Technica (reporting via wilsonsmedia.com); Engadget; The Verge (via wilsonsmedia.com); Times Now (updated 21 Oct 2026, 11:42 IST); cybersecuritynews.com.