Meta has temporarily stopped the conversation-sharing feature of its Muse AI assistant after security firm Claroc found more than 6,800 share links in public DNS records. Each share address contained the conversation's title and a random ID, so the link could be rebuilt from DNS data. Researchers saw chats containing a company's revenue, a loan application and an internal staff calendar. Meta says it is reviewing changes to how the links can be discovered.

What it means: The problem was not a breach but a design choice. When a share link puts the conversation title inside the hostname, that name ends up in public DNS records collected by various services, and the protection offered by the random ID is lost. It is a lesson for every team building sharing features: a link that requires no login must be treated as public, and its metadata must not reveal the content. For users, the incident repeats something already seen with ChatGPT, Claude and Grok: conversations with AI assistants often contain confidential business information, and one-click sharing can expose it. For businesses, it strengthens the case for a clear policy on staff use of AI tools, with limits on what may be pasted in. From a GDPR perspective, exposing third parties' personal data inside such conversations can create obligations both for Meta and for those who shared them. Because the titles remain in DNS history, part of the exposure cannot be fully undone even after the pause.

Read the original on The Verge

Related service: Custom software

Related stories