Are Meta Muse shared chats public? What to do now

Are Meta Muse shared chats public right now?

Not anymore, at least not by design. On October 20, 2026, Meta paused the Muse feature that let you share a conversation as a link. It did so after security researchers reported finding more than 6,800 Muse share addresses in public DNS records. Those pages opened for anyone who had the address, with no login needed. So a chat you shared with one colleague could be read by anyone who came across the link. Meta said it had paused the feature while it reviewed the report and looked at changing how these links can be discovered. Muse only launched on September 8, so all of this built up in about six weeks. That's not long, and it was long enough.

The researchers opened only a few hundred of the links. What they found would horrify any compliance officer. There was an internal revenue review addressed to the CEO of a marketing company and a small-business owner's loan application. There was a full year of staff scheduling for one workplace. One job candidate's notes for a confidential call with an AI lab named the internal contact and the meeting time. A to-do list included a bank fraud alert showing part of an account number. None of these people meant to publish anything. They tapped share, sent the link to someone they trusted and assumed that was the end of it. It wasn't, and that's the lesson for anyone running their working life through an AI chat.

As of now, the news is mixed. On October 20, the researchers rechecked 40 shares that had opened freely earlier in the month, and none of them loaded. The bad news is that the web addresses, including each conversation's title, are still in passive-DNS history, and nothing in your Muse account can remove them. The researchers say they've seen no evidence that anyone misused the shares. They also note they checked only one route to finding links on one product, so 6,800 isn't the full picture. Muse isn't the first, either: shared chats from ChatGPT, Claude and Grok have all shown up in search results before. That leaves every assistant user asking the same question: where do my conversations end up?

How did Muse share links end up exposed on the web?

The links leaked because of how they were built. Nobody hacked them. Muse made each share's web address out of the conversation's own title plus a random ID. A chat titled 'Q3 revenue review' got an address that literally started with q3-revenue-review, followed by a string of characters. The random part was supposed to make the link impossible to guess. The title part told anyone who saw the address that the page was worth opening. Nobody broke into Meta's servers, guessed a password or got around a login. The feature did exactly what it was built to do. Then an obscure part of the internet's infrastructure, one most people never think about, made sure those addresses didn't stay private.

Whenever your browser opens a web address, it first asks a DNS server to look up where that address lives. Some DNS providers record those lookups and let people search them. It's called passive DNS. Security teams use these archives to track phishing sites and malware, which is useful and legitimate work. The trouble starts when the address itself contains both the conversation's title and the secret ID that unlocks the page. Each time someone opened a shared Muse chat, the full address could end up in a searchable database. A single search turned up thousands of them. It only took one person, maybe the colleague you sent it to, clicking your link once.

More people need to hear this: an unlisted link is a public link, just a polite one. If a page opens without a login, it stays private only as long as nobody else learns the address. Addresses spread. They end up in browser histories, chat previews, email security scanners, link-checking services and DNS logs. Putting the title in the address made Muse's version worse, because a deleted share still leaves its title behind. A link called loan-application-final tells a stranger plenty without loading anything. So when an AI tool offers a share button, read it as 'publish to anyone who finds this' and decide on that basis. For personal admin, I'd say the honest default is not to share at all.

How do you find and delete Muse links you've already shared?

Assume that any Muse chat you've shared since launch is out there, and work through them one by one. Meta hasn't published instructions for deleting shared links in Muse specifically. The closest thing is its guidance for the Meta AI app: open the conversation, tap the menu and choose Delete link. In Meta AI, deleting either the link or the original conversation stops anyone who received it from seeing the chat. Otherwise, those links never expire. You'd expect Muse to work the same way, but Meta hasn't confirmed that, so check each chat for yourself. Once you've deleted a link, try opening it in a private browser window to make sure it's really gone.

Go through it in this order. First, open your Muse chats, including side chats, and scroll back to anything you remember sharing with a client, your accountant, a business partner or a family member. Second, search your WhatsApp, email and work chat for the links you sent. What you actually sent is usually a better record than your memory. Third, delete the share link wherever that option exists. If the conversation itself held anything sensitive, delete that too. For a full clean-up, Muse's data settings are reported to include a reset that wipes chat history, files and active tasks. It's a blunt tool. If your Muse history is mostly business admin, though, it may be the quickest way to be sure.

Deleting links won't remove the titles from DNS archives, so think about what those titles gave away. If a chat was named after a client, a deal, a lawsuit or a health issue, assume that name is known. If a shared chat contained account numbers, passwords, API keys or login codes, change them today. Don't wait to find out whether anyone used them. If a client's details were in a shared conversation, tell them. It's an awkward email, but it's much better than them hearing about it from someone else. And in future, rename a chat before you share it, or just copy the one answer you need into a message.

What should you stop pasting into any AI chat?

Don't paste anything into an AI chat that you'd hate to see on a stranger's screen. That means full account numbers, passwords, one-time codes, ID scans, clients' personal details and financials that haven't been announced yet. That's the short list, and it applies to every AI assistant, not just Muse. The problem is that AI chats feel like a private notebook. You type fast, paste in whole email threads and drop in a spreadsheet because that's quicker than summarising it. Then a sharing feature, a sync glitch or a support review turns that notebook into something other people can read. Muse users found that out this week. The material that leaked was ordinary daily work, typed by people who never imagined anyone else would see it.

A few habits lower the risk without making the tool useless. Use roles instead of names. 'The client' works just as well as a full name when you're drafting a polite payment reminder. Cut account numbers down to the last four digits, or leave them out completely. The AI doesn't need them to tell you whether a bank fee looks wrong. Paste the clause you're asking about, not the whole contract with its signatures, addresses and tax IDs. Some things should never go in at all: no password, recovery phrase or API key belongs in a chat window, whoever runs it. If a task really needs the full document, find out where that file will be stored afterwards and how you can delete it.

There's a bigger point here about who you're really writing to. Most of the Muse chats that leaked were work: revenue reviews, staff calendars and loan paperwork. If you run a business on your own or lead a team, your AI chat history is turning into a second inbox. It holds the same sensitive material as your email, without the controls you'd expect from email. Check an AI tool's privacy settings the way you'd check a new bookkeeper's references, before you hand over the keys. If you're weighing up the big agents, our side-by-side look at what OpenAI Dots and Meta Muse can read and store goes through the details question by question.

What should you ask before an assistant handles your admin?

Before you hand your reminders, follow-ups or documents to any assistant, ask five plain questions. Can anything I say end up at a public web address? What does it store, and for how long? Does it train on my conversations? Will it act or send messages without my say-so? How do I delete everything at once? A trustworthy assistant answers all five in plain words on its help pages. If you have to read three separate policies to find out whether shared chats are public, you have your answer. The Muse story shows why the first question matters most: the most damaging leak wasn't a breach, it was a feature doing what it was built to do. We've put together a longer privacy checklist you can run on any AI assistant if you want to go further.

The fourth question gets more important as assistants start doing things for you as well as answering. An agent that messages your clients, books meetings or forwards documents needs firm limits. Look for three things. It should show you exactly what it will send before anything goes out. It should say honestly who it is instead of pretending to be you. And you should be able to check on it or stop it at any point. Think about the channel, too. A separate app with its own share buttons, public pages and web dashboard has more places for things to leak than a chat you already use every day. If WhatsApp is where you already work, here's which AI agents you can actually text there.

That's the thinking behind Agent Sonic. It's a normal one-to-one WhatsApp chat with nothing to install and no dashboard to manage. It also has no share button that turns your conversation into a web page. You message it like any other contact: 'Remind me to call the accountant every Monday at 9', or send a contract PDF and ask 'What are the deadlines in this?' On the Pro plan, Sonic can also message people for you. That feature is in Beta. Before anything goes out, it shows you the exact first message. It writes from its own number and always introduces itself as your assistant, never as you. If that's how you'd like your admin handled, leave your details and you'll get Sonic's number and onboarding.

Frequently asked questions