In an email, Twitter acknowledges a “security incident” that showed Circle tweets to users outside of the Circle in April 2023 and says the bug has been fixed
Filipe Espósito / 9to5Mac :
Context & Ripple Effects
Twitter’s Circle was introduced as a small-audience posting feature, with selected groups capped at 150 people in its public rollout. Reports in April had already indicated that posts intended for those groups were appearing in non-members’ For You feeds outside their intended audience.
The company’s acknowledgement turns those user reports into a confirmed access-control failure. It matters because Circle’s value proposition depends on the platform enforcing a clear boundary between a chosen audience and everyone else.
First-order effects
- Circle users whose posts were surfaced outside their groups face a privacy and trust loss; Twitter says the underlying bug has been fixed.
- Twitter must treat Circle’s audience-selection logic as a security-sensitive control rather than merely a feed-distribution preference.
Second-order effects
- Users may limit what they share through Circle or revert to fully public posting if they cannot rely on the feature’s audience boundary.
- The incident raises the bar for testing recommendation and distribution systems that can override or bypass a post’s intended visibility settings.
Third-order effects
- If private-audience features repeatedly leak through ranking systems, platforms will need to design permissions as constraints that persist across every delivery surface, not as settings applied only at posting time.
- The broader risk is a trust gap between social platforms’ fine-grained sharing tools and their algorithmic feeds, which could make users less willing to adopt semi-private social formats.
The trend: This is one instance of the growing need to make privacy permissions durable across algorithmic recommendation systems, not just direct follower distribution.