Over the weekend of 25 July 2026, people started finding strangers’ AI conversations in Google. Medical histories. Performance reviews. API keys. Nobody got hacked. Every single one of those pages was published by the person who wrote it, using a button they thought meant something else.
The button said “Share.” Most people read that as “send this to my colleague.” What it actually did was publish a webpage on the open internet.
That gap between what the button says and what it does is the entire story. And it has now happened to Claude, ChatGPT, Grok, and Meta AI in the space of about a year. Here’s what went wrong, and the ten-minute audit that keeps your chats out of the next round of headlines.
What actually happened with Claude
A Reddit user ran a search operator called site:claude.ai/share on a Saturday evening. That query asks Google to list everything it has indexed from one specific part of a website. The result was hundreds of other people’s conversations, spread across roughly 25 pages of search results.
The BBC verified the exposure and reported it on 28 July. The chats covered legal questions, workplace projects, software development, and personal matters. Some contained tax identification numbers. Others contained what looked like proprietary healthcare research, including transcripts of private conversations.
Anthropic’s position is that this was not a breach. A spokesperson told Gizmodo that the company does not hand chat directories or sitemaps to search engines, and that share URLs are not guessable unless a person publishes the link themselves. Google’s Ned Adriance pushed the responsibility back the other way, pointing out that search engines do not decide which pages on the web are public.
Both statements are technically true, and that’s the uncomfortable part.
Here’s the mechanism. When you hit share, the platform mints a public URL. You send it to one person on Slack. That Slack workspace has a public archive, or your colleague forwards it into a Notion page, or somebody drops it in a forum thread. Now the link exists somewhere a crawler can reach it, and Google follows links for a living. No exploit required. No database touched.
Search Engine Journal’s Matt Southern dug into the crawl rules and found a configuration that fights itself. The share path was blocked in robots.txt, and the pages also returned a header telling engines not to index them. Sounds like belt and braces. It isn’t. Google’s own documentation says a noindex instruction only works if the crawler is allowed to open the page and read it. Block the crawler with robots.txt and it never sees the instruction, but it can still list the URL if it finds that URL linked from somewhere else.
Google stopped showing the results around 26 July after Anthropic updated its configuration, according to Decrypt. That fixes search. It does not fix the links, which still work for anyone who already has one.
This is a pattern, not an incident
If you only remember one thing from this post, remember that four separate companies have shipped the same mistake:
- ChatGPT, August 2025. A “make this link discoverable” checkbox pushed roughly 4,500 shared conversations into Google, including mental health disclosures and job applicant assessments. OpenAI pulled the feature entirely and worked with search providers to de-index the pages.
- Grok, August 2025. Forbes found more than 370,000 shared conversations indexed by search engines. The share button generated a URL and published it without a noindex tag. Passwords, health questions, and business details were all in there.
- Meta AI, June 2025. The standalone Meta AI app carried a Discover feed. Users tapped share expecting a private send and instead broadcast their prompts to a public stream.
- Claude, July 2026. The version you just read about.
Luc Rocher of the Oxford Internet Institute described AI chatbots to the BBC as a privacy disaster in progress. Hard to argue with that framing when the same failure keeps repeating with different logos on it.
The reason it keeps happening is that “share” carries a decade of social media muscle memory. On WhatsApp, share means send. On an AI platform, share means publish. Same word, completely different consequence.
Step 1: Find out what you have already published
Do this before anything else. It takes about a minute per platform, and most people are surprised by what’s sitting in the list.
Claude
- Open Claude on the web and click your name in the bottom left corner.
- Select Settings, then Privacy.
- Find the Shared chats entry and click Manage.
- You’ll get a list showing the title, the date shared, and the link for every snapshot you’ve published.
- Click Unshare next to anything you don’t want public. Repeat for Shared artifacts, which is a separate list.
Anthropic’s own share and unshare guide walks through the same flow with screenshots. Worth knowing: a shared chat is a frozen snapshot of everything sent before you shared it. Messages you send afterwards stay private unless you unshare and re-share, which refreshes the snapshot.
ChatGPT
- Click your profile picture, then Settings.
- Go to Data controls.
- Find Shared links and click Manage.
- Delete individually, or use the option to clear all of them at once.
One detail worth knowing from OpenAI’s shared links FAQ: anyone who opened your link could have imported that conversation into their own history. Revoking the link kills the public page. It does not reach into someone else’s account and delete their copy.
Google Gemini
- Open Gemini in a browser. This one is desktop-only.
- Click Settings and help at the bottom of the sidebar, or your profile picture, then Settings.
- Select Your public links.
- Click the bin icon beside any link you want gone, or hit Delete all links to clear the lot.
Google’s Gemini sharing documentation is blunt about the limits. Deleting a public link does not delete posts you already made containing that link on third-party sites, and it does not remove the chat from your Gemini Apps activity. Those are three separate cleanups.
Microsoft Copilot
- Open Copilot on the web, in Edge, or in the Windows app.
- Click your account icon in the sidebar, then Settings.
- Select Privacy, then Manage shared links.
- Switch between Conversation, Page, Podcast, and Task in the dropdown. Each type keeps its own list.
- Click the revoke button on anything you want pulled down and confirm.
Grok
Grok keeps separate stores for grok.com and the Grok surface inside X, so run the cleanup on both. Delete conversations from your history list, then check Settings and Data Controls. If you use Grok through X, go into your X privacy settings and delete your Grok conversation history there too. Deleting a chat does not automatically retract a link you already shared or clear anything a search engine cached, so treat that as a separate job.
Step 2: Check what search engines can still see
Unsharing kills the page. It does not instantly clear the search index or third-party archives.
One caveat before you run these. Google has already de-indexed the exposed Claude pages, so a plain site:claude.ai/share search on Google will come back empty for everyone now, not just for people whose links are safe. That’s a fixed search result, not a fixed exposure. Anything you shared is still sitting at a live URL until you manually unshare it, and other engines have been slower to clean up. Run the checks anyway, just on the right engines:
site:claude.ai/share [your name or a distinctive phrase from your work]on Bing and DuckDuckGosite:chatgpt.com/share [your name or project name]site:g.co/gemini/share [your name]site:grok.com/share [your name]
Search for your employer’s name, your product names, internal project codenames, and your own name. Those are the strings that make an anonymous chat identifiable. And regardless of what any search engine shows, go check your actual shared links list from Step 1. That’s the only place that tells you the truth about what’s still live.
If something turns up after you’ve already unshared it, use Google’s Refresh Outdated Content tool. Paste the URL, submit, and Google will re-check the page and drop the stale result. It only covers Google, so file the equivalent request with Bing separately.
Step 3: Stop creating the problem in the first place
Auditing is cleanup. These habits are prevention.
Copy and paste instead of sharing. If a colleague needs the answer, they need the text, not a live URL on somebody else’s server. Paste it into your existing doc, wiki, or email thread. No public page ever gets created. This one change removes most of your exposure.
Screenshot the useful bit. Faster than a link for anything short, and an image in a Slack thread cannot be crawled and indexed as a conversation.
Assume every share link is permanent. Not because platforms are careless, but because the internet copies things. GitHub, the Internet Archive, and countless scraper databases pick up public pages within hours. Anthropic’s own spokesperson made this point: publicly accessible content may be archived by third parties, exactly like any other web page.
Start sensitive chats in a private mode. ChatGPT has Temporary Chat, and Grok has a private mode behind the ghost icon. Nothing saved means nothing to leak later. We covered the ChatGPT version in detail in this walkthrough of Temporary Chat.
Set a quarterly reminder. Put a 15-minute calendar block every three months to run the audit above across whatever tools you use. Shared links accumulate quietly.
Split your accounts. Keep one AI account for anything you might share publicly and a separate one for medical, financial, legal, and client work. Then the sharing button in your sensitive account never has anything worth exposing.
If you manage a team, this is your problem too
The exposed Claude conversations reportedly included company documents and employee performance reviews. That’s not an individual embarrassment. That’s a disclosure event with legal weight attached, particularly under GDPR, where data minimisation and informed consent are not optional.
Three things worth doing this week:
- Write the rule down. One line in your acceptable use policy: never use the share function on AI tools for anything containing client data, personnel information, credentials, or unreleased work.
- Check your admin controls. Google Workspace administrators can turn Gemini conversation sharing on or off at the domain, organisational unit, or group level. It’s off by default. Confirm nobody switched it on. Check the equivalent setting in whatever else your organisation runs.
- Run the site: searches for your company name. Use Bing and DuckDuckGo alongside Google, since Google’s index of the exposed Claude pages has already been cleaned up and will show nothing either way. Do it now, and then repeat every quarter. Five minutes, and you’d rather find it than have a journalist find it.
If your team is also experimenting with agentic browsers, the exposure surface gets wider still. We wrote about why those tools deserve their own risk assessment.
The uncomfortable takeaway
People type things into AI chatbots that they would never put in a search box. Health worries. Salary negotiations. Draft resignation letters. Things they haven’t told their partner. The interface feels like a private notebook, and the writing style of the response reinforces that feeling.
It is not a private notebook. It is a web application with a publish button on it.
You do not need to stop using these tools. Millions of people get real value out of them every day, and this blog would be a lot shorter without them. What you need is one small correction to your mental model: the moment you press share, you are not sending a message. You are publishing a page. Behave accordingly, and none of this touches you.
Go run the audit. It genuinely takes ten minutes, and you will almost certainly find at least one link you’d forgotten about.
Your AI chats are only as private as the last button you pressed. Send this to whoever on your team uses the share function most.
Sources
- BBC News, Some people’s chats with Claude AI found to be publicly available online
- Search Engine Journal, Indexed Claude Chats Show Why Disallow Is Not Noindex
- Gizmodo, When You Share Claude Chats, You Might Be Sharing Them With Everyone
- Decrypt, Your Shared Claude Chats Were Being Quietly Published on Google
- Tom’s Guide, How to check your Claude shared chats
- Anthropic Help Center, Share and unshare chats
- OpenAI Help Center, ChatGPT Shared Links FAQ
- Gemini Apps Help, Share your chats from Gemini Apps
- Google Workspace Help, Turn Gemini App conversation sharing on or off
- Google Search Central, Block search indexing with noindex
- Google, Refresh Outdated Content tool
- TechRadar, Your Grok chats are now appearing in Google search
Just Being Resourceful! 
Leave a comment