You asked an AI to help with a loan application for the bar. It took twenty minutes, the numbers were right, and you pressed Share so your gestor could read it. The link went by email. Done.
Now imagine that page is sitting somewhere a stranger can find it. This week that stopped being imagination for a few thousand people.
What happened this week
Meta has a new assistant called Muse, and it let people share a conversation through a web link. Security researchers at a firm called Claroc found more than 6,800 of those links using nothing fancy. Opening a few hundred, they found a small-business owner's loan application with the amount requested, a company's internal revenue review, and a workplace's full-year staff holiday calendar. Their own words: "It took one query." Meta says it has paused sharing while it reviews the report.
How did strangers find links nobody had handed them? Muse built each link's address from the conversation's title plus a random code. Something like `loan-application-draft-a4c9e2` in front of the domain. And the first part of an address is recorded in public DNS records.
DNS, in kitchen-table terms
DNS is the internet's phone book. Your phone asks it "where does this name live?" and gets an answer. Some commercial services quietly keep a log of those questions and answers, and anyone can search the log. So if the name of your page says what the page is about, the log reads like a catalogue.
The random code at the end is there to stop guessing. It does. But nobody had to guess, because the title was in the name and the whole address was sitting in the log.
This is not a Meta-only problem
According to The Verge, chats from ChatGPT, Claude and Grok have also ended up in Google Search after being shared. The ChatGPT case I can check: in 2025 it had a box labelled "Make this chat discoverable". Ticking it was optional, and people ticked it. Search engines indexed their conversations. OpenAI's security chief called it "too many opportunities for folks to accidentally share things they didn't intend to" and removed the option. The Register reported at the time that other search engines were still returning results while the cleanup was going on.
The pattern is the same each time. A share link feels like a private note passed across a table. It is closer to a note taped to a window with a very long, hard-to-read address on it. Most of the time, nobody walks by. Sometimes someone builds a machine that walks by every window.
What to do about it
Three honest points, none of them dramatic.
Treat "anyone with the link" as "anyone who gets the link, by any route." Links get forwarded, pasted into group chats, logged by tools, and, as this week showed, occasionally listed. If the content would hurt in a stranger's hands (a loan figure, staff holidays, a customer's name), a link is the wrong envelope.
Share the answer, not the conversation. Copy the part you need into a document or an email and send that. The chat itself often holds more than you remember: the first draft, the figures you typed in and then corrected, the customer's surname you mentioned once. A link shares all of it.
Look at what you have already shared. Most assistants keep a list of shared links somewhere in settings. Open it, and delete the ones that have done their job. I have not checked where that list lives in every tool, and the menus change, so look for "shared links" or "data controls" in yours.
The limits
Deleting a link stops new visitors. It cannot un-ring a bell. If something was already copied, saved by a search engine or read by someone else, it stays gone from your control. That was part of the story in 2025 as well.
Also, not every shared chat is a secret. A recipe, a draft slogan, a conversation about how to fold a menu: share away. The test is simple. Would you paste it on the shop window? If the answer is "not really", don't create a link for it.
And I don't know how Muse will redesign its links, or whether every other tool is safe today. Nobody should claim that without testing. What we know is what the reports describe.
One thing to do this week
Open the AI tool you use most, find the list of shared links, and count them. If the number surprises you, delete the old ones. Then pick one chat you would have shared by link and send the answer as text instead.
If you also want to know who can read what you type in the first place, read Is Your Business Data Training Someone Else's AI?. And if staff are sharing chats you never see, Do You Need an AI Policy, or Do You Already Have One? is a good place to write this rule down.