Treat every shared AI chat link as public, and set a simple team rule
Researchers found thousands of shared Meta Muse chats on the open web, including a loan application. A short policy and a quick audit can keep your business out of that pile.
What happened
Meta says it has paused the sharing feature in Muse, its AI assistant, after researchers found shared conversations on the open web, The Verge reports. The security firm Claroc says it found more than 6,800 Muse links through public DNS records. DNS is the internet's public directory for web traffic.
According to The Verge, the feature creates a page that anyone with the link can open. Claroc says each link is built from a short title describing the chat plus a random ID, so the address itself often gave away what was inside. The researchers could view hundreds of conversations, including a marketing company's revenue review, a small business owner's loan application and a workplace's full-year staff calendar.
Muse spokesperson Tracy Clayton told The Verge in an emailed statement that the company paused the feature while it reviews the report and considers changes to how these links can be discovered.
Why it matters
It's natural to click "share" to save time, whether you're sending a draft to a colleague or showing a client an answer. It's also easy to assume the link is private because only you have it.
That assumption doesn't always hold. According to The Verge, this isn't the first time it has happened: conversations from ChatGPT, Claude and Grok have also ended up in Google Search. A shared link is closer to a posted web page than a private message.
What it means for your business
- Accounting and law firms: A pasted client spreadsheet, a draft letter or a case summary can sit behind a link that others may find. Treat client names and figures as off limits in any chat you plan to share.
- Clinics: Patient details and staff schedules don't belong in a shared AI conversation. Share a cleaned-up summary instead.
- Agencies: The Verge notes that a marketing company's revenue review was among the chats Claroc could view. Keep revenue figures and client plans out of any chat you plan to share.
- Retail: Supplier terms, loan paperwork and staffing calendars are easy to paste in without thinking. A written rule helps.
One thing to try this week
Write a three-line rule and send it to your team:
- Never put customer details, financials or HR information into an AI chat you plan to share.
- Treat every share link as public, even if it looks obscure.
- To share an answer, copy the text into a document and remove anything sensitive first.
Then spend 15 minutes on an audit. Ask each person to open the share settings in the AI tools they use, look for old shared links and delete any they no longer need. If a link holds something sensitive, delete it first and ask questions afterward.