Meta Suspends AI Chat Sharing Feature Following Security Flaw

Tech giant Meta has temporarily suspended the chat-sharing feature on its AI platform, Muse. The decision followed the discovery by security researchers that private user conversations were accessible to anyone. The issue stemmed from the method the system used to generate sharing links. ## How private chats became public Specialists at security firm Claroc discovered that shared Muse chat links were easily discoverable through passive DNS (Domain Name System) lookups. The problem was that Meta combined the domain name with the conversation title for each link, which was then documented in public DNS records. This system acts like an internet phonebook, linking domains to IP addresses. Researchers explained that a single simple search could reveal thousands of such links. In total, more than 6,800 shared chats were found, containing both personal and confidential business information. ## What data was exposed Claroc's investigation revealed that the leaked data was highly sensitive. It included details of meetings with AI labs, small business loan applications, warnings about bank fraud containing partial account information, as well as internal company calendars and work documentation. This incident highlights the critical importance of tightening privacy standards when building such platforms. In an official statement, Meta representatives noted that they suspended the functionality to study the report in detail and review the link generation mechanism. Currently, users no longer have the ability to share Muse chats via links. According to Claroc researchers, many of the links they previously accessed are no longer functional, indicating that the company has already begun addressing the issue. Meta is expected to implement more sophisticated link protection methods in the future to prevent similar incidents. For users of such AI tools, this case serves as a reminder to exercise extreme caution when using sharing features. It is essential to remember that a "shared link" does not always mean the information is intended only for the recipient, as technical flaws can make it accessible to a much wider audience.