Start a trial

Operational notes Observatory

Why shared Claude conversations ended up in Google’s search results

6 min read

A public notice board in a wooden glass case on a brick wall, sheets pinned behind the glass, a closed door beside it, in black and white
A sheet pinned on a public board is public even when nobody walks past. Indexing does not change the status of the sheet: it changes how many people walk past.

Over the weekend a Reddit post flagged something anyone could check in ten seconds: searching Google with the site:claude.ai/share operator returned shared Claude conversations. On Monday 27 July 2026 the story was published by 404 Media and picked up by TechCrunch and WIRED, which reports the same results on Bing as well. Among the material found: medical reports and clinical trial results with patients’ names, children’s names and telephone numbers, internal company documents, employee reviews containing personal data, and code and working notes sitting in public Artifacts. By the afternoon of that same Monday the same searches returned nothing. It is not the first time: as reported by Forbes, in September 2025 Google had indexed “just under 600” conversations, which then disappeared from results.

Anthropic’s position, given by spokesperson Amie Rotherham, deserves to be quoted in full: “We give people control over sharing their Claude conversations publicly, and in keeping with our privacy principles, we do not share chat directories or sitemaps with search engines.” The links, the company adds, are not guessable or discoverable unless people choose to share them themselves, and appear in search results only if they are posted somewhere crawlers can reach.

The distinction that carries everything else

These were not private chats exposed. They were conversations somebody had actively shared, by pressing a button that mints a public address. No security barrier was breached, because there was no security barrier: there was an expectation that a public address would stay hard to find. Indexing did not push that data out. It made it findable. It had already gone out the moment somebody pressed “share”.

The technical cause, verified

We checked it ourselves today, 28 July. https://claude.ai/robots.txt contains, under User-Agent: *, the directive Disallow: /share/*. A request to a claude.ai/share/<id> address answers with the HTTP header x-robots-tag: none, which is equivalent to noindex, nofollow. The /public/artifacts/ path does not appear in robots.txt at all, and its responses carry no x-robots-tag header.

That is where the defect sits, and it is a classic. Google Search Central documentation says it explicitly: for the noindex rule to be effective, the page “must not be blocked by a robots.txt file”, and it has to remain accessible to the crawler; if it is blocked, “the crawler will never see the noindex rule, and the page can still appear in search results” — for instance when other sites link to it. The Disallow stopped the crawler from reading the very instruction telling it not to index. Public Artifacts were covered by neither one nor the other.

What follows, if you buy technology

Obscurity is not a control. “Unguessable” describes how hard an address is to guess, not a permission. Whoever holds the link gets in, and the link ends up in a browser history, in a support ticket, in a group chat, in a forwarded attachment. The same holds for the “confidential” document whose address circulates by email.

The control sits upstream. The useful question is not what gets indexed, but what is allowed out. If the product has a public sharing feature and you cannot switch it off at organisation level, you have an exit route for your data that you do not govern. And one your DLP does not see, because the traffic goes to a legitimate supplier domain inside an authorised session: this is shadow AI with the door opened by the product, not by the user.

Removing from the index is not deleting. Caches, web archives, third-party scrapers and datasets already collected do not come back. De-indexing is a withdrawal from the shop window, not a product recall.

The Disallow ≠ noindex lesson is not about Anthropic alone. It applies to every internal portal, test environment or restricted area an organisation believes it is “protecting” by blocking crawlers in robots.txt. If somebody links that address from outside, it lands in the index all the same. Robots.txt tells crawlers where not to go; it does not tell search engines what not to publish, and it is never an access control.

Who answers for it. If health data, children’s data or employee reviews end up in those conversations, the party answerable for the processing is not the one supplying the model: it is the organisation that permitted that use without governing it. The controller is whoever decides purposes and means — and leaving a publishing feature switched on is a choice about means. The measures that make a trade secret defensible, and the discipline of default settings as a written decision, apply here unchanged.

What to demand from the supplier

  1. Public sharing disabled at tenant level, decided by you and not something an individual user can work around.
  2. A verifiable log of who shared what and when, exportable and retained for as long as you decide.
  3. A contractual guarantee that no client content is served from a public supplier domain.
  4. Effective revocation of links already issued, with a follow-up check that the address no longer answers — not just a button in the interface.
  5. The question that exposes everything: if tomorrow one of your employees shares a conversation with a contract inside it, who notices, and how long does it take? If the answer is “nobody”, the rest is good intentions.

The surface you cannot govern is the one that does not exist

A system that does not sit on the open web has no public sharing surface to govern, because it has none. There is no button to switch off, and no HTTP header written by somebody else to place your trust in. That is why we always deliver in two modes, never one: on-premise inside the client’s own infrastructure, or on a dedicated CSIDIA cloud — an environment reserved for the single client, accessed through a dedicated VPN, with a data centre in Italy and premises we staff ourselves. In both, the exit routes for data are a finite list, written down and verifiable, and it is the first document of our method.

Want to know which routes your AI tools give data out of, and who would notice? Half an hour with one of our experts for a first map.

Sources