Meta Pauses Muse Conversation Sharing After Public URLs Expose Private AI Chats

Meta paused Muse’s conversation-sharing feature after researchers found that shared AI chats were publicly discoverable through web searches. The feature generated URLs intended for people to share searches, conversations, images, and related work, but the links exposed chat pages beyond their intended audience. Meta said it was considering changes to the feature, according to The Verge.

The problem centers on discoverability rather than a confirmed breach of every Muse account. Ars Technica found that a single query could reveal thousands of conversations listed by title, including discussions containing personal and business information. The pause follows earlier scrutiny of Muse’s broad access to email, calendars, web services, and other user data, making the sharing flaw part of a wider debate over how much authority consumer AI agents should receive.

Muse users could create web links for conversations, a common product feature that turns private interaction histories into pages accessible through a URL. The exposed pages were then indexed or surfaced by search systems, allowing people to find chats by query instead of needing the original recipient’s link. Ars Technica’s findings included thousands of conversation titles and examples involving sensitive personal and business subjects.

Meta’s privacy guidance says Muse operates inside an isolated cloud virtual machine and maintains backups for agent history. The company says one user’s virtual machine is separated from another’s and that automated protections cover data handling, while also advising users to review Muse’s activity and grant only access they accept. The sharing incident shows that infrastructure isolation does not by itself prevent a user-created page from becoming broadly visible.

The sharing issue lands after separate incidents raised questions about Muse’s ability to act on a user’s behalf. A Facebook Marketplace experiment resulted in the agent giving a buyer a seller’s home address and arranging a pickup without the seller’s awareness, Fortune and The Guardian reported. The buyer went to the Toronto apartment, demonstrating how a seemingly routine marketplace exchange can become a physical safety problem when an agent handles communication and logistics.

Muse was introduced in September as a personal AI agent that can read email, browse the web, book travel, and make purchases. CNBC reported that Meta offered a free tier alongside paid plans priced at $20 and $100 per month, depending on usage. TIME also reported that internal instructions described Muse mapping users and their contacts, including people who do not use the service, and sharing anonymized insights across its system.

The public sharing flaw adds to concerns about the security of the systems supporting Muse. Futurism, citing 404 Media, reported that Meta engineers found and fixed a vulnerability before launch that could have allowed users to escape Muse’s virtual machine and reach Meta databases or other users’ sensitive information. That account describes a separate vulnerability from the conversation-indexing problem, but both involve the boundary between an agent’s isolated workspace and broader company systems.

The distinction matters for enterprise users. ITAdOn framed Muse as a consumer product with corporate reach because employees can install it on devices containing client data, email, calendars, and other business information. Forums.appleinsider made broader allegations that Muse accessed and uploaded Apple Messages despite user instructions, but the excerpt does not provide enough detail to establish those claims. Meta’s own guidance says no automated system is perfect and urges users to review activity, a warning that places much of the operational burden on customers.

Muse’s design combines data access with the ability to take actions, which raises the cost of ordinary mistakes. A chatbot that produces an incorrect answer creates one kind of problem; an agent that shares an address, contacts another person, or publishes a conversation can create consequences outside the app. The Marketplace incident and the indexed-chat discovery show how privacy failures can involve both digital records and real-world behavior.

Meta launched Muse while facing broader scrutiny over privacy, safety, and public trust in AI products. CNBC described the paid personal-agent rollout as an effort to expand Meta’s AI business during that scrutiny. The company’s privacy documentation provides a framework of virtual-machine isolation, backups, access controls, and user review, but the sharing pause shows that product-level defaults and search visibility remain decisive. For users, the immediate lesson is to treat shared Muse links as public until Meta completes its changes and to limit permissions to tasks that can be monitored.

Meta’s next step is expected to focus on how Muse creates, indexes, and displays shared conversations. The company has paused the feature while considering a change, according to The Verge, but the available announcement does not specify whether existing links will be deleted, removed from search indexes, or converted to access-controlled pages. Those details will determine how fully the response addresses already exposed chats.

The incident also puts pressure on Meta to explain retention, backup deletion, search indexing, and the limits of agent permissions in clearer terms. Researchers, businesses, and consumers will watch whether the company restores sharing with stronger controls or keeps it restricted. Muse’s rollout shows that an AI agent’s privacy boundary includes every connected service, generated page, and action it can perform, not just the model’s underlying virtual machine.