It seems innocuous enough: a “share” button that invites a friend or colleague to take a peek at your current AI chat session, perfect for chewing over the model’s replies or reviewing the slideshow decks, graphs, or other artifacts it created.
Time and again, though, we’ve seen shared AI chats leak over the internet. It’s happened to ChatGPT users and Claude subscribers, and Meta’s Muse is now the latest AI service to spill secrets on the web.
This isn’t an issue of rogue AI agents getting chatty about your private data. Instead, it’s a much older digital tool — a garden-variety URL — that’s the culprit.
Welcome to another edition of Prompt Mode, your weekly AI newsletter.
I’m your host, Ben Patterson. Each week on Prompt Mode, I’ll be serving up analysis of the AI trends that matter to everyday users like you and me. Stay tuned for practical AI tips, hands-on experiences with the latest AI tools, and–you guessed it–prompts to help you get the most out of your AI assistants.
Thanks for reading, and if you like what you see, just sign up right here.
In the latest incident, privacy researchers at Claroc discovered that it took just a single DNS query to sniff out more than 6,000 shared Muse chats, including conversations with such sensitive data as a small-business loan application, partial bank account numbers, lists of employee names, and internal business reports riddled with PII (personally identifiable information) and raw revenue figures.
The problem, as it turns out, was Meta’s decision to use the title of the chat within the web address, making it easy to find the shared conversations using a passive DNS search.
Meta yanked Muse’s sharing feature shortly after Claroc researchers informed them of the breach pending “changes to how these links can be discovered.”
Muse users aren’t the only ones to see their AI chats exposed on the internet. This past summer, a number of Claude users got a rude shock when their shared conversations showed up in Google search results, a repeat of a similar episode last September. Earlier last year, some ChatGPT users learned their AI chats were searchable on Google, too. In each of those cases, the shared AI convos were ultimately removed from Google search.
While the details of the Meta Muse incident are different from the ChatGPT and Claude cases — the Muse chats were exposed via DNS queries, while the ChatGPT and Claude threads were crawled by Google — they all stem from a common vulnerability.
Namely, the vehicle for sharing ChatGPT, Claude, and Meta chats (oh, and Gemini chats too) is a publicly accessible URL that can be accessed by anyone who gets it.
Having previously been burned by chat links showing up on Google, the big providers have taken measures to keep search bots from crawling shared links, and it sounds like Meta will take steps to keep its shared conversations from being plucked from DNS queries. Likewise, the Claude app now lets you invite specific users to share your chat threads, rather than just anybody.
But even if they don’t show up in Google search, shared ChatGPT, Claude, Gemini, and Meta links are still at the mercy of whomever you share them with, meaning they could easily be dropped into an email or (even worse) a social post.
If you really want to share something from an AI chat, consider asking the AI to summarize the pertinent information only, or to create a PDF rather than sharing the entire chat. ChatGPT, Claude, and other big AI providers also let you check which AI chats you’ve already shared and unshare them.
Most importantly, ask yourself this: Would I be comfortable pasting this AI chat on the back of a postcard? If not, you probably shouldn’t share it using a public URL.
More in AI this week
- Ever heard of PHP? It’s a core element of some of your favorite websites (including PCWorld, we hope), and AI helped spot a critical PHP vulnerability this week that left much of the web scrambling for fixes. (PCWorld)
- 1Password now allows ChatGPT Dot, Grok Bot, and other AI agents to handle your usernames and passwords without the agent actually seeing them. What happens once your agent gets into your account is a whole different issue. (PCWorld)
- OpenAI’s GPT-6 is said to be much more adept as Cobol and Fortran, which is good news for shoring up the defenses of financial institutions that depend on those aging programming languages. (The Decoder)
- My vibe-coded AI assistant had strict rules about what it could and couldn’t do. Unwittingly, I’d also left a loophole in the code that left my agent wide open to attack. (PCWorld)
- Researchers at MIT stranded AI agents on a virtual deserted island and watched them create their own games, build structures, and even write their names in blocks. (Gizmodo)
Prompt of the week: The “where have I lived” prompt
Mortgage and rental forms want years of past addresses, and even for the well organized, tracking them down can be a tedious and frustrating process.
This is the kind of task that AI agents were born to do. If you’re willing to connect Google’s Gemini Spark to your Gmail account (which, I realize, isn’t necessarily the case), you can ask the agent to scour your past messages for leases, move-in dates, utility connection receipts, and other documents to help piece together your address history.
That’s all for now!
Thanks for reading the latest issue of Prompt Mode.
Want more next week? Don’t forget to sign up to start receiving this newsletter in your inbox.