I was surprised that people were surprised to find Claude chats in Google search results.

When you share an AI chat via a link, you might expect it to stay between you and your friend. But that URL points to a public web page. Whoever has the link has access. And if it leaks, it will eventually, and your “private” conversation with an AI is public.

Over the past few days, hundreds of shared Claude conversations have appeared in Google search results. Reporters found medical reports on real patients, clinical trial data with names attached, contact details for primary school-aged children, internal company documents, and employee reviews containing personal information. It is quite plausible that people discuss sensitive matters with a chatbot precisely because they would not say them out loud to anyone else. All of it is searchable.

Anthropic missed the noindex tag or a robots.txt disallow on the shared pages, so Google’s crawler treated them as ordinary public content. This is not new. ChatGPT had the same issue last year. Grok, Meta AI, and Google’s Bard (now Gemini) have all been caught in variations of the same pattern.

Developers know the GitHub version of this story, but many still do not fully grasp it. Make a repository public “for a few minutes” while debugging, then flip it back to private. You think you got away with it. You did not. GHArchive quietly records every public event on GitHub, continuously. Earlier this year, Truffle Security researchers used it to scan force-pushed and deleted commits dating back years, and pulled thousands of live secrets, including GitHub tokens and AWS credentials, from repos that developers thought they had cleaned up.

The lesson is the same as with shared AI chats. Exposure is a one-way ratchet. You cannot un-publish. “Private again” is not a state that erases the “public” moment. The internet does not forget.

For anyone shipping a product with a Share button: a cryptic URL is not a privacy model. It is a social convention with an HTTPS certificate. Real limited sharing needs authentication, per-recipient tokens, expiry, and, at a bare minimum, a proper noindex plus robots.txt setup so search engines do not turn your users’ quiet conversations into a public archive.

Update on whether this is fixed

As I gathered, Anthropic added the missing noindex tag by July 27, so shared Claude chats no longer appear in Google. But before the fix landed, someone had already scraped over 11,000 exposed conversations to GitHub. The one-way ratchet in action.

OpenAI went further after their own incident and removed the discoverable share feature entirely. Grok now lets users cancel share links after the fact, but it is not clear they block search engines from indexing new ones. Meta AI added a warning that your chat will be public when you tap Share, but the public feed inside the app still exists.

Anthropic’s official position is that the system is working as intended, because users chose to share. Technically true. But whether the average person clicking Share understood that Share meant publish to the open web is the exact gap this post is about. The bug is patched. The design pattern that caused it is still shipping.

Sources

On the pattern point, three earlier examples of the same failure mode:

About the author

Viren Mantri is a cybersecurity advisor and former senior technology leader across Standard Chartered, UBS, McAfee, and KPMG. After three decades at the intersection of technology, risk, and regulation, he now helps organisations cut through complexity and make better security decisions.

CC-BY Viren Mantri, 2026, licensed under a Creative Commons Attribution 4.0 International License.

Disclaimer: All views expressed here are entirely mine.