Ep. 259 | Meta's Muse Share Links Exposed Loan Applications and Staff Calendars

Meta paused the share-link feature in Muse, its AI assistant, after security researchers found more than 6,800 shared Muse chats they could locate through public internet records, including a small-business owner's loan application and a workplace's full-year staff vacation calendar. Mike and Frank explain it in plain English. A share link is a web address an AI tool makes for one conversation so you can send it to someone else; whoever has the address can open it, with no login. Security firm Claroc found that Muse put each conversation's title right in the web address, and once someone opened a link, that address showed up in public DNS lookup records that companies index and sell searches of. One search returned more than 6,800 Muse share addresses, readable by title. Most of the few hundred the researchers opened were harmless, but a minority held a loan application, a CEO's revenue review, a bank fraud alert with part of an account number, and a staff vacation calendar. Claroc says it has no evidence anyone misused them. What Meta said: people can share specific Muse artifacts, which creates a page anyone with the link can access, and Meta has paused the feature while it reviews the report and considers changes to how those links can be discovered. Claroc says it reported the issue to Meta's bug bounty program on October 8; Meta paused sharing on October 20, and none of 40 old links rechecked that day still opened. The titles remain in DNS history. Why it matters if you don't use Muse: every AI tool's share link works for whoever ends up holding it. ChatGPT links from personal accounts open for anyone with the link and don't expire; links made inside a ChatGPT Business workspace open only for members of that workspace, and Claude Team and Enterprise chats can only be shared inside the organization. Locking a ChatGPT chat doesn't delete a link you already shared. Takeaway: run a fifteen-minute share-link sweep. In ChatGPT, go to Settings, Data controls, and click Manage next to Shared links; delete what you don't need, or choose Delete all shared links. In Claude (Free, Pro, Max), go to Settings, Privacy, and click Manage next to Shared chats, then Unshare. Set one rule: no share links for money, staff, or customers. Read a chat's title before you share it. Ask each person for one number, how many links they found. Treat Muse sharing as off until Meta explains what changed. Sources: Ars Technica, "Meta Muse exposes users' personal and business secrets when they share conversations" — https://arstechnica.com/security/2026/10/meta-muse-exposes-users-personal-and-business-secrets-when-they-share-conversations/ · The Verge, "Meta pauses Muse sharing after researchers find AI chats on the web" — https://www.theverge.com/tech/1014627/meta-muse-ai-sharing-ai-chats · Claroc research, "GhostShares" — https://blog.claroc.io/ghostshares-muse-passive-dns/ · OpenAI Help Center, "Sharing conversations and scheduled tasks in ChatGPT" — https://help.openai.com/en/articles/7925741-sharing-conversations-and-scheduled-tasks-in-chatgpt · Claude Help Center, "Share and unshare chats" — https://support.claude.com/en/articles/10593882-share-and-unshare-chats More Control AI Profit: https://ctrlaiprofit.com · All episodes: https://www.buzzsprout.com/2596090 · Email the show: [email protected] Topics: Meta · Muse · AI privacy · share links · ChatGPT shared links · Claude shared chats · small business data --- Frequently Asked Questions What happened with Meta Muse share links? Researchers at Claroc found more than 6,800 shared Muse chats they could locate through public DNS records, because Muse put each conversation's title in the share web address. Some held sensitive business details. Meta paused the sharing feature while it reviews the report. Are my ChatGPT or Claude chats public? No. Chats are private by default. Only chats you choose to share by link can be opened by someone else, and on personal accounts anyone who has that link can open it. Business workspace links in ChatGPT, and Team and Enterprise shares in Claude, stay inside the organization. How do I find and delete my shared AI chat links? In ChatGPT: Settings, Data controls, Shared links, Manage, then delete individual links or Delete all shared links. In Claude: Settings, Privacy, Shared chats, Manage, then Unshare. --- About the Hosts Michael is a small business owner and entrepreneur since 1983, founder of Cadenhead Services and 850 Media. He speaks from four decades of real operational experience — not whitepapers. Frank is an AI — an OpenClaw-powered agent serving as Digital Media Director at 850 Media. An AI co-hosting a show about AI for business owners is not a gimmick. It is a live demo of exactly what the show is about. Send us Fan Mail Support the show Ctrl AI Profit — Real AI. Real Business. No Hype. CtrlAiProfit.com X: @CtrlAIProfit TikTok: @CtrlAiProfit YouTube: @CtrlAiProfit [email protected] Produced entirely by AI. Yes, really....