Shared Claude Chats Turned Up in Google Search, and Why Disallow Is Not Noindex

Hundreds of conversations that people had shared from Claude turned up in Google search results in late July 2026, and among them were cryptocurrency wallet seed phrases, apparent Social Security numbers, payroll spreadsheets with employee names, internal CRM exports and files listing school-aged children with their phone numbers. Anthropic has since closed the gap and Google has pulled the results, but a copy of the exposed material had already been archived by a third party. This is a case worth understanding in detail, because the mistake behind it is one of the most common on the web and it is not obvious even to experienced teams.

How it surfaced

On 25 July a Reddit user typed a single query into Google, site:claude.ai/share, and got back page after page of other people's conversations. The thread climbed to roughly 4,000 upvotes. An independent consultant, Daniel J. Glover, had flagged the underlying misconfiguration a day later, and 404 Media reported it on the Monday.

Nothing was hacked. Every one of those pages had been deliberately published by the person who owned the conversation, using the share button. What they did not expect was that "share this link with a colleague" would also mean "list this in a public search engine".

The technical mistake, and why it is so easy to make

This is the part worth reading carefully, because the fix everyone assumes is correct is the fix that caused the problem.

Anthropic's robots.txt did block the share pages. You can still read it today at claude.ai/robots.txt, and the line is there: Disallow: /share/*. The pages themselves also returned an x-robots-tag: none header, which is the instruction that actually removes a page from search results.

Both measures were present, and together they cancelled each other out.

That is the whole failure in one sentence: the instruction to stay out of the index was written on a door that had been locked from the outside. Google's own documentation says this plainly, that a noindex rule only works if the page is not blocked from crawling. Separately, the path serving Claude Artifacts was not listed in robots.txt at all.

The lesson generalises far beyond one company. If you want a page crawled but not listed, you must let the crawler in and serve it a noindex. If you want it neither crawled nor listed, robots.txt alone will not get you there, and you need real access control instead.

Why removing the links did not end it

Anthropic updated its configuration and added noindex tags, and Google began dropping the results on 26 July. Bing was still returning shared links after that. But the more permanent problem had already happened: someone had put a GitHub repository together holding 11,241 messages from 453 conversations in plain text.

Search engines forget. Archives do not. Anyone who unshares a chat today stops future visitors from opening the link, and changes nothing about a copy that was taken while it was open. For a seed phrase or a Social Security number, the correct response is not to unshare the page, it is to treat that secret as compromised and rotate it.

A company spokesperson, Amie Rotherham, said the links "are not guessable or discoverable unless people choose to share them themselves". That is accurate about how the links are generated and beside the point about what happened, because once a search engine has listed a URL, nobody needs to guess it.

What to do if you have ever used a share link

1. Open Settings, then Privacy, then Shared Chats, and review everything listed there. Revoke what you do not need public.
2. Treat anything sensitive that appeared in a shared conversation as exposed. Rotate API keys, passwords and recovery phrases rather than assuming the link was never opened.
3. Check the same setting in every other assistant you use. This is a product-design pattern, not a quirk of one vendor.
4. Remember that revoking a share is not deletion. It closes the door going forward.

The part a VPN does not solve

It is worth being blunt here, because this is where privacy advice usually gets sold badly. A VPN would not have prevented any of this. Nothing was intercepted in transit and nobody needed to know your IP address. The data left through the front door, published by the account holder, and was then catalogued by a search engine doing exactly what search engines do. Encrypting the connection protects the journey; it has nothing to say about a document you chose to publish at the destination. The exposure that matters here is what you type into the box, which is the same lesson as when query summaries were passed from ChatGPT to Meta and when a web page could turn an assistant into a phishing tool.

Conclusion