No. A share link usually opens without a login for anyone who has it, often never expires, and can be passed on. Treat a shared AI conversation as published, and share a copy of the part you need instead of the whole chat.
What happened
Meta has paused link sharing in Muse, its personal AI agent, after the security firm Claroc found more than 6,800 shared conversations without guessing or brute-forcing a single address. Engadget's report lists what was in them: meeting times with a frontier AI lab, a small-business loan application, a bank fraud alert with partial account details, a company's vacation calendar and other internal documents. Meta said it had "paused this functionality while we review this report and consider changes to how these links can be discovered."
Muse launched on September 8. Claroc's write-up says it collected the hostnames on October 7 and 8, reported them to Meta's bug bounty on October 8, and on October 20 found that none of 40 shares it had opened before would load.
How a share link ended up in a public list
Each Muse share got its own web address, and the address was built from the conversation's title followed by a random ID. The random part was meant to make the link impossible to guess. The problem was where the address went next.
When anyone opens a link, their browser first looks the hostname up in DNS, the system that turns names into server addresses. Some DNS providers record the names they see and sell searchable archives of them, a service called passive DNS. So every time someone opened a Muse share, its full hostname, title and random ID included, could land in one of those archives. In Claroc's words: "One passive-DNS search brings back thousands of them, listed by name, like a table of contents."
Nobody needed to break anything. The ID was secret only until the first person opened the link, and the title told a searcher which links were worth opening.
A share link is a publication, not a message
Muse is the current example, not the only one. Claroc quotes Meta's own help page for shared Meta AI conversations: "people with the link will be able to see your conversation," the link "doesn't expire," and it can be reshared. Most chat products work the same way. The differences between them are in the details, so check yours against these questions:
Find and remove the shares you have made
Most assistants keep a list of your shared links somewhere in settings. In ChatGPT it is under Settings, then Data controls, then Shared links. Gemini has a page of your public links. Wherever it lives in your tools:
- Delete the share, not the chat. In some products deleting the conversation also kills the link, and in others it does not. Removing the share from the shared-links list is the step that reliably cuts access.
- Open the old link afterwards. Use a private window. If it still loads, the share is still live.
- Assume anything that was shared was copied. Deleting a link stops new visits. It does not recall what someone already saw or saved. If a shared chat held a password, an API key or account details, change them.
How to share without publishing
- Share the answer, not the conversation. Copy the part your colleague needs into an email or a document with access controls. The rest of the chat, including what you pasted in to get there, stays with you.
- Read the title before you share. Assistants write titles from your first message, so a chat about a client's loan can be titled with the client's name. In Muse's case the title was part of the address itself.
- Keep sensitive work out of agents that can share at all. For financial, legal or personnel material, use a tool your organisation has set up with sharing turned off or limited to signed-in colleagues.
If you run IT for a team
Claroc's recommendations are practical: find out who is using Muse, tell staff what a share link actually does, flag public share creation in the AI tools you allow, and if you cannot see Muse sharing, block muse.ai and metaaiusercontent.com at your proxy or DNS filter. Its last suggestion applies to every tool you use: search passive DNS and urlscan for the content domains of your own AI and SaaS tools, and see what of yours is already out there.
What is still open
Meta has not said when sharing will come back or how links will work when it does, and has not said whether it will tell the people whose shares were exposed. Claroc opened a few hundred of the 6,800 links, so the full extent of what was readable is not known.
The story is in the October 20 briefing. For what Muse is and the access it asks for, read Meta Muse, explained. For keeping work data out of AI tools in the first place, read the LLM security and privacy guide for businesses, and if a key did end up somewhere it should not, what to do when an API key is exposed.
Explore curated tools related to this guide: