---
title: "Why shared Claude conversations ended up in Google’s search results"
description: "On 27 July Claude’s public links surfaced on Google and Bing. The verified technical cause, and why an “unguessable” address is not a control."
url: https://csidia.com/en/notes/conversazioni-claude-condivise-indicizzate-google/
lang: en
date: 2026-07-28
label: "Observatory"
publisher: CSIDIA S.r.l. (https://csidia.com/)
italiano: https://csidia.com/note-operative/conversazioni-claude-condivise-indicizzate-google/
---

# Why shared Claude conversations ended up in Google’s search results

Over the weekend a Reddit post flagged something anyone could check in ten seconds: searching Google with the `site:claude.ai/share` operator returned shared **Claude** conversations. On Monday **27 July 2026** the story was published by 404 Media and picked up by TechCrunch and WIRED, which reports the same results on Bing as well. Among the material found: medical reports and clinical trial results with patients’ names, children’s names and telephone numbers, internal company documents, employee reviews containing personal data, and code and working notes sitting in public Artifacts. By the afternoon of that same Monday the same searches returned nothing. It is not the first time: as reported by Forbes, in September 2025 Google had indexed “just under 600” conversations, which then disappeared from results.

**Anthropic**’s position, given by spokesperson Amie Rotherham, deserves to be quoted in full: “We give people control over sharing their Claude conversations publicly, and in keeping with our privacy principles, we do not share chat directories or sitemaps with search engines.” The links, the company adds, are not guessable or discoverable unless people choose to share them themselves, and appear in search results only if they are posted somewhere crawlers can reach.

## The distinction that carries everything else

These were not private chats exposed. They were conversations somebody had **actively shared**, by pressing a button that mints a public address. No security barrier was breached, because there was no security barrier: there was an expectation that a public address would stay hard to find. Indexing did not push that data out. It made it **findable**. It had already gone out the moment somebody pressed “share”.

## The technical cause, verified

We checked it ourselves today, 28 July. `https://claude.ai/robots.txt` contains, under `User-Agent: *`, the directive `Disallow: /share/*`. A request to a `claude.ai/share/ ` address answers with the HTTP header `x-robots-tag: none`, which is equivalent to `noindex, nofollow`. The `/public/artifacts/` path does not appear in robots.txt at all, and its responses carry no `x-robots-tag` header.

That is where the defect sits, and it is a classic. Google Search Central documentation says it explicitly: for the `noindex` rule to be effective, the page “must not be blocked by a robots.txt file”, and it has to remain accessible to the crawler; if it is blocked, “the crawler will never see the `noindex` rule, and the page can still appear in search results” — for instance when other sites link to it. The `Disallow` stopped the crawler from reading the very instruction telling it not to index. Public Artifacts were covered by neither one nor the other.

## What follows, if you buy technology

**Obscurity is not a control.** “Unguessable” describes how hard an address is to guess, not a permission. Whoever holds the link gets in, and the link ends up in a browser history, in a support ticket, in a group chat, in a forwarded attachment. The same holds for the “confidential” document whose address circulates by email.

**The control sits upstream.** The useful question is not what gets indexed, but **what is allowed out**. If the product has a public sharing feature and you cannot switch it off at organisation level, you have an exit route for your data that you do not govern. And one your DLP does not see, because the traffic goes to a legitimate supplier domain inside an authorised session: this is [shadow AI](https://csidia.com/en/notes/shadow-ai-governare-non-vietare) with the door opened by the product, not by the user.

**Removing from the index is not deleting.** Caches, web archives, third-party scrapers and datasets already collected do not come back. De-indexing is a withdrawal from the shop window, not a product recall.

**The `Disallow` ≠ `noindex` lesson is not about Anthropic alone.** It applies to every internal portal, test environment or restricted area an organisation believes it is “protecting” by blocking crawlers in robots.txt. If somebody links that address from outside, it lands in the index all the same. Robots.txt tells crawlers where not to go; it does not tell search engines what not to publish, and it is never an access control.

**Who answers for it.** If health data, children’s data or employee reviews end up in those conversations, the party answerable for the processing is not the one supplying the model: it is the organisation that permitted that use without governing it. The controller is whoever decides purposes and means — and leaving a publishing feature switched on is a choice about means. The measures that make a [trade secret](https://csidia.com/en/notes/segreto-industriale-prova-misure-adeguate-ai) defensible, and the discipline of [default settings as a written decision](https://csidia.com/en/notes/impostazioni-predefinite-decisione-di-conformita), apply here unchanged.

## What to demand from the supplier

1. **Public sharing disabled at tenant level**, decided by you and not something an individual user can work around.
2. **A verifiable log** of who shared what and when, exportable and retained for as long as you decide.
3. **A contractual guarantee** that no client content is served from a public supplier domain.
4. **Effective revocation of links already issued**, with a follow-up check that the address no longer answers — not just a button in the interface.
5. The question that exposes everything: **if tomorrow one of your employees shares a conversation with a contract inside it, who notices, and how long does it take?** If the answer is “nobody”, the rest is good intentions.

## Sources

- [Google Search Central — “Block Search indexing with noindex”: the rule does not apply if the page is blocked by robots.txt](https://developers.google.com/search/docs/crawling-indexing/block-indexing)
- [404 Media — “Tons of Peoples' Claude Chats and Creations are Exposed on Google” (27 July 2026)](https://www.404media.co/tons-of-peoples-claude-chats-and-creations-are-exposed-on-google/)
- [TechCrunch — shared conversations and Artifacts in search results, with Anthropic’s position (27 July 2026)](https://techcrunch.com/2026/07/27/psa-your-claude-shared-chats-and-artifacts-may-have-ended-up-on-google/)
- [WIRED — the results that surfaced on Google and on Bing (27 July 2026)](https://www.wired.com/story/private-claude-chats-exposed-in-google-and-bing-search-results/)
- [Search Engine Journal — “Indexed Claude Chats Show Why Disallow Is Not Noindex” (27 July 2026)](https://www.searchenginejournal.com/indexed-claude-chats-show-why-disallow-is-not-noindex/583852/)
- [Forbes — the September 2025 precedent: “just under 600” conversations indexed](https://www.forbes.com/sites/iainmartin/2025/09/08/hundreds-of-anthropic-chatbot-transcripts-showed-up-in-google-search/)

Note by CSIDIA S.r.l. (Vignola, MO, Italy): https://csidia.com/en/notes/conversazioni-claude-condivise-indicizzate-google/ · Who we are and what we do: https://csidia.com/en/at-a-glance/ · engagement@csidia.com