Amanda Silberling, writing for TechCrunch:

Numerous Twitter users are reporting a bug in which Circle tweets — which are supposed to reach a select group, like an Instagram Close Friends story — are surfacing on the algorithmically generated For You timeline. That means that your supposedly private posts might breach containment to reach an unintended audience, which could quickly spark some uncomfortable situations.

I observed this bug when a tweet from someone I follow appeared on my For You timeline, but the retweet button was disabled, despite the person’s account being public. When I clicked on the tweet, it disappeared. I asked the tweeter if that post was intended for their Circle — which I am not in — and they confirmed this was the case. [...]

TechCrunch has spoken to multiple users who have also experienced this glitch firsthand; many more have reported the glitch in their tweets. Most often, it seems that Circle tweets are being surfaced in the For You timeline to users who follow the poster, but are not in their Circle. Others have reported that their Circle tweets are reaching even further than those who follow them.

Other privacy-related bugs I’ve seen people mention recently:

• Will Oremus saw tweets in his timeline from people who had blocked him.
• Ian Coldwater, testing the privacy of Twitter Circles, created a circle with just one other person, sent a tweet to that circle, and it was shown to several people not in the circle.
• Replying to Coldwater, Whitney Merrill argues that this is a data breach under EU law, and could result in hefty fines.

I don’t trust anything “private” about Twitter, including and especially DMs. Some kind of breach regarding DMs seems inevitable at this point, given how sloppy Twitter is getting under Phony Stark.