Shared Chats Aren’t Private. Meta Just Suspended the Feature That Proved It.
TL;DR: Security researchers found that Meta’s Muse assistant built each shared conversation’s web address out of the conversation’s own title. Those addresses get logged in public DNS records, so one search returned more than 6,800 share links — findable by people who were never sent them. Meta suspended sharing on 20 October. The lesson outlives the bug: in every AI tool you use, shared chats are published web pages, not private messages.
What happened
Security firm Claroc published the research on 18 October and calls the result GhostShares — share pages that open for people who were never given the link and who found them on their own.
The mechanism is almost disappointingly simple. When you shared a Muse conversation, Muse turned it into a page anyone with the link could open, with no login. It built the address from the conversation’s title plus a random ID, on a Meta content domain (`cf.metaaiusercontent.com`). The first time anyone opened that page, the hostname — title and all — was recorded in passive DNS, the public running record of which domain names get looked up. From there, a single search lists them. Claroc’s description, quoted by Engadget: “One passive-DNS search brings back thousands of them, listed by name, like a table of contents.”
The random ID was supposed to make each link unguessable. It didn’t matter, because nobody had to guess — the whole address was already written down in public.
The numbers, stated precisely. Claroc enumerated more than 6,800 share hostnames after filtering out scanning noise, and opened only a few hundred of them. That distinction matters and some coverage has blurred it: 6,800 links were found, not 6,800 shared chats read. Separately, the public scanner urlscan.io already held over 75 saved scans of Muse share pages.
Most of the shared chats Claroc opened were harmless — small-business sites, event calendars. The sensitive minority is the part worth reading twice: a candidate’s preparation notes for a confidential executive-search call with a frontier AI lab, a company’s internal revenue review, a small-business loan application, a to-do note containing a bank fraud alert with a partial account number, a property investor’s performance report including addresses, and a workplace’s staff holiday calendar. Claroc withheld all identifiers.
The timeline: Muse launched 8 September. Claroc collected its sample on 7–8 October and reported it to Meta’s bug bounty programme on 8 October. Ars Technica put the research to Meta on 20 October, and Meta’s response, as relayed by Engadget: “we’ve paused this functionality while we review this report and consider changes to how these links can be discovered.” Claroc rechecked 40 previously-open shares afterwards; none opened.
Three things to keep this fair. Claroc sells a product that flags public AI share links, so read its research the way you would any vendor’s. It says plainly that it has no evidence anyone misused the shares, and that it cannot tell how long any page was reachable or whether others found them first. And Meta moved quickly once asked.
Why shared chats are published, not sent
Here is the bit that matters whether or not you have ever heard of Muse.
When you share a document, you are granting access to a thing that stays where it is. When you create one of these shared chats, most tools make a new public web page and hand you its address. There is usually no password, no account check and no expiry. Sharing in this context is a publish button with a friendlier name.
We wrote almost exactly this story in July, when Claude’s shared chats turned up in Google. Claroc’s own post notes earlier exposures of shared ChatGPT and Grok conversations too. Four tools, four companies, one pattern in how shared chats work — which is the strongest possible sign that this is a design convention rather than one vendor’s mistake.
What makes the Muse case worth your ten minutes is the second-order detail. Meta has suspended sharing, and the pages no longer open. But the hostnames stay in passive-DNS history — which means the titles of those conversations remain searchable, permanently, even though the conversations behind them are now shut. If you ever titled a chat “Redundancy plan — Dave” or “Loan application figures”, the title is the part you cannot take back.
Three checks to do today
- Find your shared chats in every AI tool you use, and delete the ones you no longer need. Each tool keeps a list of its shared chats somewhere in settings. Most people have more than they remember, because sharing is how you show someone an answer.
- Stop putting anything identifying in a chat title. This is the Muse-specific lesson that generalises: the title was the address. Names, company names, amounts and “confidential” all belong in the conversation, never in what it is called.
- Before you click share, ask whether you would post it. That is the only test that actually works, because it assumes the link will travel and does not depend on any vendor’s promise about discoverability.
If you run a business where staff use AI assistants, Claroc’s own advice is worth repeating: treat an AI share link as an outbound transfer of the conversation’s contents, and tell people so before it matters rather than after.
Who should care (and who shouldn’t)
How much of this applies depends on what you are doing with AI.
- Building a revenue app: care. Shared chats from a build session routinely contain customer data, pricing and architecture you would not publish.
- An internal tool for your business: care most. This is the category where the exposed examples sat — revenue reviews, loan applications, staff calendars.
- A website or landing page: low exposure, unless you shared a chat to get feedback on copy that is not public yet.
- Learning: mostly fine. Shared chats are how learning happens. Just keep names out of the titles.
- No idea yet: you are only exposed once you press share. Knowing what the button does is the whole job.
Our take
We would not single Meta out for this. The honest reading of four vendors making the same choice is that “share” became a publish button by convention, while users kept reading it as “send” — and the fix is a product-design one, not something users should have to compensate for. Meta’s suspension within hours of being asked is the right response, and the eight-day stretch between Claroc’s report and that suspension is the part we would want explained.
What we would change in our own habits is smaller and more boring: treat shared chats as permanent and public from the moment they are created. The Muse models we wrote about last week and the sharing feature suspended this week are the same lesson arriving twice — the convenience is real, and so is what it quietly does with your material.
Not sure which AI build tool fits how you actually work? Take the 60-second Vibe Coding Tool Finder quiz →
Some links on this page are affiliate links. If you buy through them we may earn a commission at no extra cost to you.
FAQ
Were 6,800 Meta Muse conversations read by strangers?
No. Claroc enumerated more than 6,800 share hostnames and opened only a few hundred itself. It states it has no evidence anyone else misused them, and it cannot tell how long each page was reachable or who else found them.
Is deleting a share link enough to undo this?
It stops people opening the shared chats, which is the important part. But in the Muse case the hostname — including the conversation’s title — stays in passive-DNS history afterwards, so the title itself cannot be withdrawn.
Are shared chats in other AI tools private?
Generally no. In most tools a share link creates a public page with no login. Shared Claude, ChatGPT and Grok conversations have all previously turned up where their owners did not expect. Assume anything you share is published.
