Meta Pauses Muse Conversation Sharing Feature After 6,800 AI Chat Links Exposed Publicly

Meta recently took the emergency step of pausing the conversation-sharing feature of its AI assistant Muse after researchers at security firm Claroc discovered that more than 6,800 conversation links generated through the feature could be accessed by anyone on the public web. The incident once again shines a spotlight on the privacy boundaries of AI conversations.

Incident Recap: AI Conversations Exposed Through Public DNS Records

According to Ars Technica, Claroc researchers discovered more than 6,800 Muse conversation links through public DNS records. These links pointed to complete chat logs between users and the Meta AI assistant, and users may never have realized that this content would be publicly indexed.

DNS records are part of the internet's infrastructure, used to resolve domain names into IP addresses. When large numbers of similarly formatted subdomains appear in public DNS, researchers can discover and enumerate these conversation endpoints in bulk. This means that even without actively sharing, conversation links may be systematically collected through technical means.

In its response, Meta said it has paused the sharing feature and is evaluating the relevant mechanisms. However, the company did not disclose how long these links were exposed or whether any user data was actually scraped.

DNS Records and Subdomain Enumeration
DNS (Domain Name System) is the internet's "phone book," responsible for translating human-readable domain names (such as example.com) into machine-readable IP addresses. In addition to common A records and CNAME records, DNS contains many other types of records, and these are typically publicly queryable. When a company generates a unique subdomain for each sharing link (such as chat123.example.com), these subdomains appear in DNS records. Attackers or researchers can use subdomain enumeration tools (such as Sublist3r or Amass) or Certificate Transparency Logs to discover these subdomains in bulk. Once a subdomain is listed, the corresponding URL may be directly accessible, thereby exposing content that was meant to be private. This exposure does not stem from a hacker attack, but rather from a failure to consider "discoverability" risk during system design.

Root Cause: Misalignment Between Sharing Link Design and Privacy Expectations

Muse's conversation-sharing feature allows users to generate an accessible link to send chat logs to others. The problem is that the design of these links appears to assume "undiscoverability"—that is, only someone who has the link can view it. But the existence of public DNS records breaks that assumption.

From a technical perspective, any URL generated in a predictable way may be enumerable. Security researchers often exploit this to discover exposed services. Claroc's findings suggest that Meta may lack sufficient randomness or access control in its link generation mechanism.

The deeper issue lies in user expectations. Most users believe that AI conversations are private and that the sharing feature is merely a temporary convenience. When links become publicly discoverable, the boundary between private conversations and public content blurs.

UUIDs and Enumerability
UUID (Universally Unique Identifier) is a standard widely used to generate unique identifiers (such as UUIDv4), and its randomness is sufficient to prevent brute-force guessing. However, the randomness of a UUID does not equate to non-enumerability. If the generation pattern of sharing links has regularities (for example, based on timestamps, user IDs, or auto-incrementing sequences), or if links are submitted to publicly indexable pages (such as search engines or social media), then even with UUIDs, links may be collected and enumerated. In addition, if links lack access controls (such as passwords or login verification) or expiration times, they will remain permanently valid once leaked. Therefore, secure design needs to combine randomness, access control, and index protection (such as robots.txt or noindex headers) to reduce discoverability.

Industry Context: Privacy Controversies Over AI Conversation Sharing Are Not Isolated Cases

This is not the first time an AI assistant has sparked privacy controversy over a sharing feature. As AI chatbots become widespread, mechanisms such as conversation sharing, conversation links, and public indexing are becoming new risk points.

Compared with other platforms, Meta's Muse feature is relatively aggressive in its sharing design—directly generating publicly accessible web pages. Some competitors adopt stricter access controls, such as requiring login to view or setting link expiration times.

Claroc's research method also suggests a broader auditing approach: using DNS records and public indexes to discover unintended exposure surfaces in AI services. This method is low-cost and highly efficient, and may be adopted by more security teams.

Certificate Transparency Logs and Public Indexing
Certificate Transparency (CT) is a public logging system designed to monitor and audit SSL/TLS certificates. Whenever a website deploys a new certificate, that certificate is recorded in public CT logs, including domain name information. Researchers can query CT logs to discover newly launched subdomains, even if those subdomains do not appear in DNS records. Combined with DNS enumeration, CT logs can greatly improve the efficiency of discovering accidentally exposed services. For AI conversation-sharing features, if sharing links use independent subdomains or paths and do not adopt anti-indexing measures, they are easily captured by such public logs and indexing mechanisms. This suggests to developers that privacy design must consider the visibility ecosystem of the entire internet, not just the randomness of the link itself.

What Users and Developers Should Watch For

For ordinary users, this incident reminds us: before using the sharing feature of any AI assistant, first confirm whether the link can be indexed by search engines and whether it has an access password or expiration setting. If the conversation contains sensitive information, the safest approach is not to use sharing links.

For developers, the lesson from Muse is that the randomness, access control, and discoverability of shareable links need to be part of security design. Generating a UUID is not enough to prevent enumeration; rate limiting, access logs, and index protection are also needed.

Meta said the pause is a temporary measure but did not provide a timeline for restoration. In the fast-paced iteration of AI products, privacy design often lags behind feature launches. This incident may push more companies to conduct similar security audits before launching sharing features.

Conclusion

The number of 6,800 links is not enormous, but the exposure mechanism is worth vigilance. AI conversations are becoming a new vehicle for personal data, and design flaws in sharing features may allow this data to flow into the public web without users' knowledge. Meta's pause is a necessary first step, but the more critical issues are the subsequent fixes and transparency.

One-line Summary

Meta paused Muse's conversation-sharing feature after 6,800 AI chat links were exposed through public DNS records.

Paragraph Summary

Meta urgently paused the conversation-sharing feature of its AI assistant Muse after researchers at security firm Claroc discovered more than 6,800 publicly accessible chat links through public DNS records. These links pointed to complete conversations between users and Meta AI, and users may never have realized that the content would be publicly indexed. The root cause is that the design of sharing links assumed "undiscoverability," but public DNS records and enumerable URLs broke that assumption. The incident highlights the lack of link randomness, access control, and index protection in AI conversation-sharing features. Industry context shows that similar privacy controversies are not isolated cases, and users and developers need to be alert to the discoverability risks of sharing links and take corresponding protective measures.