Meta has temporarily suspended the chat-sharing feature of its AI assistant Muse. Concerns are growing about the exposure of personal information and internal corporate materials after a problem was found that made URLs of user-shared conversations easy to search from outside.

On Oct. 20, tech media outlet The Verge reported that security firm Claroc said it found more than 6,800 Muse conversation sharing addresses by analyzing internet domain lookup records.

Muse had provided a feature that generates a sharing link so users can pass conversations with the AI to others. Anyone with the link could access the page without a separate login.

The problem was the way links were generated. Muse created URLs by combining a short phrase describing the conversation title and content with a random identification number. In the process, the conversation title and identification number were included in the domain address, and the address was recorded in DNS lookup history, allowing third parties to find the shared page.

Claroc researchers said they directly viewed hundreds of conversations in this way. They included internal corporate sales review materials, a small business owner's loan application, employees' annual vacation schedules, and notes from a job seeker preparing for a private meeting with an AI research lab.

The researchers said they were able to access sensitive information without separate accounts or authentication procedures.

Tracy Clayton (트레이시 클레이턴), a Meta Muse spokesperson, said, "If a user shares a specific output, a page is created that anyone with the link can access." Clayton added, "We suspended the feature while reviewing the report and discussing ways to improve the link discovery method."

Claroc reported that it notified Meta of the problem on Oct. 8, and 40 shared pages it rechecked on Oct. 20 no longer opened. Not all of the roughly 6,800 addresses found contained sensitive information. There is also no evidence so far that an outside attacker exploited them.

Cases have previously emerged at ChatGPT, Claude and Grok in which shared conversations were exposed on search engines. Some point out that convenient sharing features in AI services are emerging as a new information security risk.