Shared Claude Chats Were Indexed by Google, Exposing Private Data

Over the weekend of 26–27 July 2026, Reddit users discovered that Claude conversations shared via Anthropic's built-in Share feature were turning up in Google search results. These weren't leaked database records or the product of an intrusion — they were public snapshot pages that users themselves had generated to pass a conversation along, sitting unprotected against search-engine crawlers. Security commentator Bruce Schneier flagged the story on 4 August; Fortune and Malwarebytes had already documented the exposed content days earlier.

What was in the exposed chats

Because people use Claude for everything from debugging code to journaling, the exposed pages ranged from mundane to genuinely sensitive:

• Cryptocurrency wallet private keys
• API keys and other credentials pasted into coding sessions
• Personal information, including names, home addresses and phone numbers
• Source code for an AI-powered therapy app someone had built with Claude
• A dashboard built to analyse medical billing data
• Notes from private business meetings

A missing noindex tag, not a breach

The mechanism behind the exposure is mundane, which is exactly the point for anyone threat-modelling consumer AI tools. Claude's share feature generates a public URL for any conversation a user chooses to pass along. Those pages were reachable without authentication and, on the evidence of what Google indexed, lacked a noindex directive telling crawlers to stay away. Google's crawler treated them like any other public webpage, and a site-specific search was enough to surface other people's chat history. Google has since de-indexed the affected pages, but that only removes discoverability — the underlying links are still live for anyone who already holds the URL.

Anthropic's framing: a sharing choice, not a flaw

We give people control over sharing their Claude conversations publicly, and in keeping with our privacy principles, we do not share chat directories or sitemaps with search engines like Google. These shareable links are not guessable or discoverable unless people choose to share them themselves. When someone shares a conversation, they are making that content publicly accessible, and like other public web content, it may be archived by third-party services.

— Anthropic statement, reported by Fortune

That's a defensible position as far as it goes — sharing is opt-in, and publishing a link does make the content public in principle. But "not guessable" undersells the real attack surface: a crawler doesn't need to guess a URL once it finds one linked anywhere on the open web, and once indexed, a shared chat is discoverable to anyone typing a plausible search term, not just people holding the original link. Fortune's reporting notes this is also not the first time Anthropic has faced a version of this problem, citing a similar incident in 2025.

What this means for security teams

For readers running AI governance programmes, the lesson isn't really about Anthropic specifically — it's about the gap between a vendor's default settings and what staff actually do with a sharing feature under deadline pressure.

• Treat any "share this conversation" feature in a consumer AI tool as equivalent to posting to a public URL, and write that into acceptable-use policy, not just a settings screen
• Audit what your organisation's AI usage policy says about pasting credentials, medical data, or client information into any chatbot, shared or not
• For ISO 42001 or similar AI governance work, log and periodically review which SaaS AI tools have public-sharing features enabled by default
• If you've ever shared a Claude, ChatGPT, or similar conversation link, treat it as burned — rotate any credentials or keys it contained rather than assuming de-indexing undoes the exposure