On Saturday, July 25, a Reddit user typed an ordinary query into Google: site:claude.ai/share. It returned hundreds of strangers’ Claude conversations and Artifacts (VentureBeat). On July 27, 404 Media followed up, and what reporters found in those results included medical reports and clinical trial results with patient names, documents carrying the names and phone numbers of school-age children, company documents marked internal-only, employee performance reviews, crypto wallet keys, and erotica that Claude’s usage policy says shouldn’t exist in the first place (TechCrunch, Malwarebytes).

By the afternoon the story broke, TechCrunch reran the search and Google returned nothing. According to Malwarebytes, Wired found results still sitting in Bing.

Anthropic spokesperson Amie Rotherham told TechCrunch: “These shareable links are not guessable or discoverable unless people choose to share them themselves. When someone shares a conversation, they are making that content publicly accessible, and like other public web content, it may be archived by third-party services.”

Every clause of that is accurate. The problem is the word “share”: what the user thinks it means and what the product actually does are two different things.

What “share” actually does

Per Anthropic’s help documentation, clicking the share button creates a snapshot page of the conversation up to that point, viewable by anyone with the link. Messages sent afterward stay private unless you reshare, which updates the snapshot. To revoke a link, you flip the chat’s visibility back to Private, and Settings > Privacy > Shared chats lists everything you have ever shared.

One detail in that document is worth holding up against the rest: on Team and Enterprise plans, chats can only be shared with members of the same organization. For business customers, sharing is treated as an access-control problem. The consumer product has no such layer.

And one thing I checked myself: as of August 4, the document does not mention search engines once. Not third-party archiving either. The entire promise a user can read is “anyone with the link can view it.”

What happens between one click and a Google result

The first link in the chain is the access model itself. A long unguessable URL is what security people call a capability URL: the link is the credential, and holding it means access. That model works only as long as links stay put. Links don’t stay put. They get pasted into Reddit threads, group chats, and emails; messaging apps fetch them to build preview cards; archiving services collect them. Once a link surfaces anywhere public, a search crawler can follow it in. Google’s own documentation says one of the main ways it discovers new URLs is by extracting links from pages it already knows about.

Anthropic’s position is that links only become discoverable when users post them publicly, and in the cases found so far that is indeed the leak path. Whether it is the only path is less settled. In the September 2025 incident (Forbes), when Google indexed just under 600 Claude conversations, including prompts from Anthropic’s own team along with staff names and email addresses, at least one user told Forbes they had never posted their work conversation anywhere. How that link leaked remains a dispute between the two accounts.

The second link in the chain is the blocking mechanism, and to see what went wrong here you need to know how Google search works. I’ll assume you have never looked at this machinery.

When you search Google, it doesn’t sweep the live web for answers. It consults an enormous address book it compiled in advance: which URL holds what content, recorded ahead of time, so that a search is a lookup. To compile the address book, Google sends out an automated program (the “crawler”) that walks from page to page along links, reading content as it goes.

What matters is that “the crawler read the page” and “the page is in the address book” are two separate events. If a URL has been linked from any public page, Google knows that URL exists and can enter it in the address book without ever reading the page. The search result then shows up as a bare link with no snippet, but the link still opens.

A website has two tools, and they act on different steps:

  • robots.txt is a sign at the front door: “crawlers, keep out.” Well-behaved crawlers obey and never read the page. But the sign has no power over the address book: Google learned the URL from someone else’s page and can list it anyway.
  • noindex is a note inside the room: “please don’t put this page in the address book.” Google honors it, and it is the mechanism that actually keeps a page out of search results. But the note is written inside the page, so a crawler has to walk in to see it.

After the 2025 incident, Anthropic’s remediation, per Forbes, was to withhold chat directories and sitemaps from search engines and “actively block them from crawling our site.” That is tool number one: the sign on the door. Put the two rules side by side and the failure writes itself. The sign keeps the crawler out, so the crawler never sees the noindex note; and the sign alone can’t stop the URL from being listed. Adding one defense disabled the defense that works. This is not my inference: Google’s documentation warns about this exact combination, stating that for noindex to take effect, the page must not be blocked by robots.txt.

So the correct fix is the reverse: open the door (allow crawling) and write a noindex note into every share page. I verified both halves myself. Writing this on August 4, I first fetched claude.ai’s current robots.txt: /chat/, /settings, and other paths are on the keep-out list, but /share is not, so crawlers may enter share pages. Then I created a share link and fetched the page source. The head contains <meta name="robots" content="noindex, nofollow">, exactly the note that keeps a page out of the address book. Third-party reporting matches what I fetched: per DigitalToday, the direct cause of this incident was the missing noindex tag; Anthropic added it on July 26, and Claude share links started dropping out of Google results.

In plain terms: the crawler can now walk into a share page, reads the note the moment it enters, and Google declines to list the URL. So as of August 4, under Google’s own rules, newly shared Claude conversations should stay out of Google search results. noindex only takes effect once a crawler reads the page, so the cleanup won’t finish overnight, but the blocking now works the way Google’s documentation says it should. To be precise about scope: this stops search engine indexing and nothing else. A share link is still a public web page that anyone holding it can open, and copies already taken by third-party archive services are not coming back.

The fifth time

The same incident has happened at least five times that the industry can count.

September 2023: SEO consultant Gagan Ghotra noticed Google had indexed shared Bard conversations (Gigazine). Google search liaison Danny Sullivan responded that the shared chats were never meant to be indexed and that Google was working on blocking them; the fix was a robots.txt rule.

Summer 2025: ChatGPT’s turn. This time users had at least ticked an explicit “Make this chat discoverable” checkbox, and Fast Company still found more than 4,500 indexed conversations, resumes and emotional confessions among them (Tech Digest). On August 1, OpenAI CISO Dane Stuckey killed the entire feature: “Ultimately we think this feature introduced too many opportunities for folks to accidentally share things they didn’t intend to, so we’re removing the option” (Malwarebytes).

August 2025: Grok. Forbes reported around 370,000 conversations indexed by Google. The share button generated a public page with no warning or disclaimer to the user; the exposed content included at least one password and intimate medical questions, and images and spreadsheets users had uploaded were reachable through the share pages.

Add Claude’s September 2025 incident and this one. Four companies, four implementations, from Grok’s silence to ChatGPT’s explicit checkbox, all arriving at the same place. The checkbox didn’t save ChatGPT, because users didn’t know what “discoverable” meant. Meta AI’s Discover feed is yet another variant: it made publicness the product itself (Malwarebytes).

Where the blind spot is

When a user clicks share, the mental model is “show this result to someone.” The implementation is “create a public web page that stays live until revoked.” Between those two sits an entire act of publication. An ordinary web page is written by an author for the public. A chat log is different: what people type into a chat box is close to talking to themselves, and medical history, finances, and raw emotion all end up in there. I wrote on July 23 about how HIPAA’s protection ends the moment you hand your medical records to a consumer chatbot: the law binds health care providers and the services processing data on their behalf, not data users type in on their own. This incident is the other face of the same problem. The data left the regulatory boundary, then went straight into a search index.

There is an old rule in trust and safety work: users don’t read documentation, and the only disclosure that works is the one shown at the moment of action. Whether the share dialog says “this creates a public web page that search engines and archive services may pick up” decides whether the user presses the button. Right now Anthropic doesn’t have that sentence even in its help docs.

One more thing most people don’t expect: revoking a share only blocks future access. It does not delete copies third parties have already archived. Anthropic’s own statement concedes that public content “may be archived by third-party services.” A snapshot held by an archive service answers to no AI company.

Where I land

Three rules for users:

  • Treat every share link as a publication. Before sending one, ask yourself whether you’d be comfortable with the content on a blog under your name.
  • Go through Settings > Privacy > Shared chats now and revoke what you no longer need. Revoking won’t reach archived copies, but it stops access from here on.
  • Keep genuinely sensitive material out of the conversation entirely. Wallet keys have no business in any cloud chat box, shared or not.

For people building these products: block indexing with noindex, not robots.txt; Google’s docs have spelled out the difference for years. Put “this is a public web page and may be indexed by search engines” in the share dialog, not in a help center article. And give users one page that lists everything they’ve shared. Anthropic did build that page, and it deserves credit.

The judgment: Anthropic is only the most recent name on the list. One design decision, implementing “share” as “publish” without saying so plainly, has now produced five incidents in three years. As long as the share button mints a URL that is public by default and live until revoked, while the dialog copy stops at “anyone with the link can view,” I don’t expect this to be the last one. The next headline will just carry a different logo.

References