Meta Pauses Muse Sharing After Researchers Discover AI Chats Exposed on the Web
A security firm found Muse conversations containing a marketing company's revenue figures, a workplace calendar, a loan application, and other sensitive material.
By Emma Roth
What Happened
Meta has temporarily suspended sharing features for its Muse AI assistant after security researchers discovered that user conversations were publicly accessible on the open web. The disclosure raises fresh concerns about how conversational AI platforms store, index, and expose user data β an issue that has become increasingly urgent as chatbot adoption has surged through 2025 and into 2026.
Sensitive Data Found in the Wild
The security firm's investigation uncovered Muse chat logs that included:
- A marketing company's internal revenue figures
- A workplace's shared calendar
- A personal loan application
- Additional sensitive material the firm declined to detail publicly
The exposure suggests that shared or indexed Muse conversations were not adequately protected, allowing third parties to access content users likely assumed was private.
Why It Matters in 2026
The incident lands amid heightened scrutiny of AI data handling. With the EU AI Act's transparency obligations now in force and several U.S. states implementing chatbot disclosure requirements, companies face growing pressure to demonstrate that conversational data is secured by default. Meta's pause signals how quickly a single research finding can force a major platform to rethink its sharing architecture.
It also underscores a recurring pattern in the generative AI era: features designed to make AI assistants more social and collaborative can inadvertently turn private prompts into public records.
What's Next
Meta has not yet announced a timeline for restoring sharing functionality. The company is expected to conduct a review of how Muse conversations are indexed and surfaced before reintroducing any public-facing features. Users who previously shared Muse chats are advised to review their activity and revoke access to any links they may have distributed.
This is a developing story. Check back for updates.
via The Verge AI