According to a report, researchers at cybersecurity firm Clarock identified more than 6,800 shared links by examining passive DNS records, which can help track domain-related activity and reveal web addresses.
Researchers reportedly accessed several hundred conversations through these links. The chats allegedly contained sensitive information, including corporate revenue assessments, loan applications, bank fraud alerts, partial account details and confidential notes from job interviews.
How the Privacy Risk Emerged
The report attributed the issue to Muse’s URL design, which included conversation titles and randomly generated identification codes. When users accessed shared links, the web addresses could be stored in public databases, potentially allowing other people to discover them even if the links had not been sent to them directly.
Researchers also reportedly found that viewing the conversations through these links did not require users to sign in to a Meta account, raising further concerns about the accessibility of private information.
Following the disclosure, Meta suspended the chat-sharing feature to address the reported privacy risks.
The incident highlights broader concerns about data protection in AI applications, particularly when users share conversations containing confidential financial, personal or business information.
The reported findings underscore the importance of carefully managing shared links and ensuring that AI platforms have safeguards to prevent unintended access to private conversations.