Meta suspends Muse chat-sharing feature over privacy concerns

Meta has suspended conversation sharing in its Muse artificial intelligence (AI) assistant after cybersecurity researchers discovered that thousands of shared chat links could be found through public internet records, potentially exposing sensitive personal and corporate information.

Cybersecurity firm Claroc identified more than 6,800 shared links through passive DNS records, which log domain-name lookups and can make web addresses discoverable.

Researchers accessed several hundred conversations, some containing sensitive information, including corporate revenue reviews, loan applications, bank fraud alerts with partial account details and confidential job interview notes.

The flaw stemmed from Muse’s URL design, which included conversation titles and randomly generated identifiers. Once accessed, the links could be recorded in public databases, allowing others to discover them without receiving them directly. The conversations could then be viewed without signing in.

The incident highlights growing concerns about data privacy in AI applications and the risks of sharing conversations containing confidential information.