Meta has paused Muse’s sharing feature while reviewing researchers’ findings that shared conversation pages could be discovered by people who had not received their links, according to company responses published by Ars Technica and The Verge on October 20, 2026. (Ars Technica)

The distinction is important: the reported exposure concerns pages users asked Muse to create for sharing. It does not establish that private, unshared conversations were exposed or that someone broke into users’ accounts. (Claroc)

Muse spokesperson Tracy Clayton told The Verge that sharing specific artifacts creates pages accessible to people holding their links. Meta said it had paused that functionality while reviewing the report and considering changes to how those links could be discovered. (The Verge)

What researchers found

The Verge reported that security firm Claroc found more than 6,800 Muse links through public DNS records. That is a count of discovered links, not a verified number of affected people or sensitive conversations. The outlets’ coverage describes the same research, rather than independent replication. (The Verge)

Researchers reportedly opened a few hundred pages without logging in; most were harmless, while a minority contained personal records and internal business documents. (Quartz)

The reported mechanism involved the hostname—the domain portion of a web address. Muse placed a conversation title and random identifier there. A passive-DNS service observing a lookup could record that hostname, making both elements discoverable. The researchers therefore did not need to guess the supposedly obscure identifier. (Claroc)

In practical terms, someone could discover the address through a record of internet infrastructure activity rather than receive it from the person sharing the page. The title could also reveal something about the material before the page was opened. This was not simply a finding that conversations appeared in ordinary search-engine results. (Claroc)

What remains uncertain

Claroc’s findings do not measure total exposure. Its research covered one discovery channel and one hostname pattern, and the firm said it could not establish how long pages had been reachable or whether others had found them first. It reported no evidence of misuse. (Claroc)

The company statements reviewed for this article confirm the pause, but do not provide a comprehensive account of the status of every previously shared link. A feature suspension should not, by itself, be read as confirmation that all historical traces or copies of shared content have disappeared. (Ars Technica)

Muse-specific sharing-interface language also remains unverified. Without that evidence, it is not possible to determine precisely what warning users saw when creating these pages, or whether the interface clearly distinguished a publicly accessible link from access limited to selected recipients.

Link sharing is not recipient-only access

The broader issue extends beyond conversational AI: possession of a link and permission tied to a person are different access models. Microsoft’s documentation for OneDrive and SharePoint, updated in August 2026, explicitly separates links available to anyone, links restricted to an organization, and links restricted to specific people. (Microsoft Learn)

Microsoft says its anyone links require no authentication and can be forwarded. Its specific-people links, by contrast, require recipients to authenticate as someone designated by the sender. This comparison illustrates the relevant design choice; it is not evidence that Microsoft’s products share Muse’s reported discovery mechanism. (Microsoft Learn)

For developers, that distinction changes the security question. Making an address difficult to guess is not the same as checking who opens it. A recipient-restricted design can deny access even when someone else obtains the address. An unrestricted link instead places much more weight on keeping the address within its intended audience. (Microsoft Learn)

OpenAI’s current ChatGPT documentation makes a similar audience distinction. Personal-account conversation links are available to anyone holding them, while links created in managed Business, Enterprise and Edu workspaces are restricted to eligible members of the originating workspace. These are documented access rules, not a claim of immunity from other security problems. (OpenAI Help Center)

The same documentation warns that deleting a shared link stops future access through that link but does not remove conversations another person has already saved. It also advises reviewing the entire shared preview, because shared conversations can include supported images and uploaded files as well as text. (OpenAI Help Center)

For organizations, the practical implication is to evaluate sharing separately from permission to use an AI assistant. A policy allowing staff to draft material does not answer whether that material should become accessible through a transferable link. The relevant questions are what is being shared, who can open it, and what remains after access is withdrawn—not merely whether the intended recipient received the message. (Microsoft Learn)