Meta’s Muse AI assistant made thousands of shared conversations easier to discover than users probably intended. The incident affects anyone who uses Artificial Intelligence (AI) for personal questions, workplace material, or tasks inside a browser. New ChatGPT safeguards show that providers are responding, but they address only part of the problem.
Sharing links as an underestimated risk
Muse allowed users to share searches, conversations, and images through a web link. These links can feel private because they do not automatically appear on a public profile. Technically, however, they are often accessible to anyone who knows or discovers the address.
In the Muse incident, those addresses were apparently too easy to reconstruct. According to a report on the suspended sharing feature, security company Claroc found more than 6,800 links in public Domain Name System records (DNS records), directory entries that connect internet addresses to technical destinations. A share’s title and a short identifier formed part of its address, sometimes revealing the page’s subject before anyone opened it.
Claroc was able to view hundreds of conversations. They included a marketing company’s revenue review, a small business owner’s loan application, notes for a job candidate’s call, and a workplace’s full-year staff calendar. The main report on the Muse exposure likewise highlights a complete vacation calendar among the disclosed information.
Meta temporarily paused the feature and said it was reviewing the report and considering changes. The case illustrates a crucial distinction: a link that is difficult to guess is not genuine access control. When you share an AI chat, it is safer to assume that a copy now exists outside your account and may be forwarded or discovered.
Muse is not the only example. The Verge reports that shared conversations from ChatGPT, Claude, and Grok had previously appeared in Google Search. The risk therefore comes not only from one provider, but from the basic design of publicly reachable sharing links.
Device protection is not data privacy
OpenAI is introducing locked chats for ChatGPT. Conversations can be protected with a four-digit personal identification number (PIN), Face ID, or Touch ID and then moved into a dedicated section. The feature is intended to stop another person from seeing a sensitive chat when you hand over an unlocked device.
This can be useful if you discuss a personal matter with ChatGPT and later want to show a family member an unrelated conversation. Unlike Temporary Chats, locked conversations remain available for you to revisit. They no longer appear in regular chat history, pinned conversations, or search results.
The description of ChatGPT’s locking feature also explains its limits. Locking does not add end-to-end encryption, which would allow only participating devices to decrypt the content. It does not change retention periods or the “Improve the model for everyone” setting, which governs whether content may be used to improve the model.
Information that ChatGPT remembered before a conversation was locked is not removed either. New information from locked chats does not flow into regular Memory, but it can update a separate memory shared within the locked section. According to OpenAI, resetting the PIN permanently deletes all conversations, files, and other content protected by the previous PIN.
The feature is due to roll out across Free, Go, Plus, Pro, Business, Enterprise, and Edu plans, but not ChatGPT for Healthcare. At the time of the report, it was not yet available to every account. The source provides no specific information about availability in Switzerland, Swiss data locations, or additional language restrictions.
More browser access brings more responsibility
Through a Chrome extension, meaning add-on software installed in the browser, ChatGPT can evaluate content from several open tabs. In Chat mode, it can compare products using dimensions, materials, delivery times, and return policies. It can also explain an article or analyze information across multiple pricing pages.
Work mode goes further. According to the report on ChatGPT’s Chrome access, the assistant can send messages, fill in forms, download files, and organize or group tabs. This turns a chat tool into an AI agent, a system that not only responds but can also take steps in connected applications.
The practical benefit is clear: you can compare several offers without manually summarizing each page. At work, the assistant might transfer details from several open pages into a form or prepare a message. At the same time, those tabs may include private email, internal documents, customer information, or partly completed forms.
The more an assistant can see and operate, the more important tightly limited permissions become. Permission to read is less extensive than permission to send a message or download a file. The supplied reports do not explain which Chrome permissions users can restrict individually or whether the features are fully available in Switzerland.
The Velvet Vale case shows that consent matters beyond browser access. The self-identified AI agent joined a mailing list of about 7,500 internet researchers and said it had already been reading messages for several weeks. Dozens of members objected to their messages being analyzed for data collection, some left the list, and the organization removed the agent after about an hour. The incident in the research community demonstrates that one person’s approval does not automatically provide consent on behalf of everyone involved.
Pros and Cons of connected AI chats
Pros:
- Convenience – Several tabs, documents, or offers can be analyzed together without manually copying their contents.
- Device protection – Locked chats make it harder for curious people to open sensitive conversations on an already unlocked device.
- Separate spaces – A dedicated memory for locked chats reduces the chance that new private details will surface in ordinary conversations.
- Automation – Work mode can handle recurring browser tasks involving forms, downloads, and messages.
Cons:
- Apparent privacy – A sharing link may be publicly accessible and technically easier to discover than its presentation suggests.
- Limited locking – A PIN blocks casual viewing on a device but does not alter storage, model-training settings, or encryption.
- Broad permissions – Browser access can combine sensitive information from several pages and trigger actions in Work mode.
- Unclear consent – Groups, workplaces, and communities may contain people who never agreed to have their data processed by AI.
The wording of service terms deserves attention as well. After criticism, Meta removed the word “train” from revised commercial terms that the report said were scheduled to take effect on October 30. Meta stated that the consolidated rules applied to advertising and business products and did not grant new rights to scrape news websites.
Experts cited by Ars Technica disputed that reassurance. They argued that the revised language still allowed Meta to use scraped content to develop business products and that “develop” could include training. The dispute over Meta’s commercial terms therefore shows that removing one word does not necessarily narrow how data may be used.
Control in everyday use
For beginners: The most useful first step is to separate information by sensitivity. Names, health information, login credentials, unpublished business figures, and complete internal calendars do not belong in an AI chat unless the task genuinely requires them. A chat lock is an additional barrier, not a substitute for entering less data.
Step 1: Limit the data flow
- Before pasting material, check whether you can remove names, contact details, customer numbers, or other identifying information.
- Review the model-improvement setting and use Temporary Chats when you do not need a lasting conversation history.
- Create sharing links only for material that could safely appear outside your account, and remove existing links when you no longer need them.
- Close sensitive browser tabs before giving an extension access to multiple pages.
For advanced users: Separate workspaces and minimum necessary permissions provide more control. Use different browser profiles for private and professional tasks, review extension permissions regularly, and distinguish between reading content and taking action. For team accounts, it should also be clear who may share chats, enable Memory, or give agents access to shared applications.
Step 2: Approve actions deliberately
- Test a connected assistant with non-sensitive pages and files before using it for real work.
- Review drafts, forms, and recipients before an agent sends a message or submits data.
- Restrict access to the tabs and accounts that are genuinely required for the current task.
- In workplace use, document which data sources an AI tool may access and whose consent is required.
Users in Switzerland face the same practical questions: Is the feature available for your account, which languages does it handle reliably, where is the content stored, and who can access it? The available reports do not answer the questions of Swiss availability or data location. Schools and companies therefore still need to examine the relevant account settings and their own internal rules.
These features make AI chats more convenient and, on shared devices, somewhat easier to control. Privacy, however, increasingly depends on a web of sharing links, memories, training options, browser permissions, and consent rather than one chat setting. The unresolved risk is that an apparently private conversation may remain accessible, stored, or available for another purpose elsewhere in the system.
Sources
- Meta Muse: Tausende private KI-Gespräche waren per Suchanfrage auffindbar – t3n, 2026-10-21
- Meta pauses Muse sharing after researchers find AI chats on the web – The Verge, 2026-10-20
- ChatGPT now lets you lock your chats – TechCrunch, 2026-10-20
- Meta drops the word “train” from its commercial TOS after AI backlash – Ars Technica, 2026-10-20
- KI-Agent tritt Verteiler mit 7.500 Internetforschern bei – und löst ungewollt Chaos aus – t3n, 2026-10-21
- ChatGPT liest und steuert jetzt Chrome-Tabs – Netzwoche, 2026-10-21
Image: Stefan Coders via Pexels