People are unknowingly publishing their private Meta AI chats to a public feed

A feature meant to showcase interesting exchanges with Meta’s AI chatbot has instead turned into a running exposure of some of its users’ most private conversations. Medical questions, legal disputes, and personal confessions have all surfaced in the Meta AI app’s public Discover feed, often posted by users who had no clear idea their prompt would ever be visible to strangers.

A share button with no obvious warning attached

The core of the problem traces to how the app’s sharing controls are presented during setup and everyday use. On iPhones, there was no clear indication during initial setup that chats would default to public visibility unless a user manually changed the relevant setting, while Android users encountered only a brief message that was easy to miss in the flow of getting the app running. The result is a share button that, in practice, has let large numbers of people publish content to a public feed without registering that “public” meant visible to anyone browsing the app rather than a small circle of contacts.

The kinds of conversations that ended up exposed

The categories of content that surfaced in the Discover feed span some of the most sensitive topics people bring to any confidential conversation. Medical queries about post-surgery symptoms and mental health struggles have appeared alongside legal matters including job-termination arbitrations and eviction notices. Personal material has included confessions about affairs and financial anxieties, and in some cases prompts touching on illicit planning such as tax evasion strategies, published in the feed alongside real usernames rather than anonymized identifiers.

Why real usernames make the exposure worse

Much of what makes this pattern more damaging than a typical data leak is the pairing of sensitive content with identifiable accounts. A user asking a chatbot about a medical symptom or a legal dispute is often typing exactly the kind of detail they would never post to a public social feed under their own name, precisely because they assume the conversation is private. When that same content surfaces attached to a real username, it collapses the distinction users were relying on between a confidential AI exchange and a public social media post, without the user ever making an active decision to blur that line.

That distinction matters because a username tied to a real identity can be cross-referenced with other public information relatively easily, turning what looks like an anonymous prompt into something searchable and attributable. A legal question about an eviction, paired with a real name, can be found by a landlord, an employer, or simply a curious stranger scrolling the feed, long after the original user has forgotten the exchange ever happened. Once published, that kind of content can also be indexed or archived outside Meta’s own systems, meaning even deleting a post after the fact may not fully undo its exposure.

Meta’s response: a warning added after the fact

After the issue drew attention, Meta added a warning that appears when a user taps the app’s Share button, displaying a “Post to feed” prompt with text stating that prompts posted are public and visible to everyone, that Meta may suggest those prompts on other Meta apps, and advising users to avoid sharing personal or sensitive information. That addition addresses the moment of sharing going forward, but it does not retroactively protect the volume of sensitive conversations already published to the feed before the warning existed, nor does it change the underlying design choice of defaulting some sharing flows toward public visibility in the first place.

Why a chatbot’s memory of a conversation adds another wrinkle

Beyond the immediate exposure of a single shared prompt, many AI assistants, Meta’s included, are also designed to remember details from past conversations to make future responses more personalized. That combination, a chat history that persists across sessions and a sharing interface that can publish individual exchanges without clear warning, means a single confusing tap does not just expose one isolated question but can surface context the assistant has accumulated about a user over multiple prior conversations. Anyone relying on an AI assistant’s memory features for convenience is, in effect, trusting that the same interface will not also make that accumulated personal context easier to expose publicly than a one-off, memoryless exchange would be.

How this fits a wider pattern across AI chat products

Meta AI is not the only assistant built with a public or social discovery layer sitting alongside private conversation, as competing products have similarly experimented with community feeds, shared prompt galleries, and social features layered on top of what most users still think of as a private chat interface. The recurring theme across these incidents is a mismatch between how a product’s designers think about sharing, as a feature to be opted into deliberately, and how users actually experience the interface, often skimming past a setup screen or a small in-app prompt without registering that a meaningful privacy decision was embedded in it. That mismatch is why security and privacy researchers increasingly recommend checking an AI app’s sharing and visibility settings directly after installation, rather than assuming a chat-style interface implies chat-style privacy by default.

This article was produced with AI assistance and edited by Morning Overview staff.

More from Morning Overview