On July 26, a Reddit user posted a one-line trick that turned Claude’s share feature inside out: run site:claude.ai/share on Google, and the search engine returns thousands of users’ shared conversations. Claude’s share button generates a public webpage - no login, no authentication, no expiry - and the people who clicked it were never told that “share” meant “publish to the open internet.” Within days the community was hunting through the results for fun, and what they found was worse than awkward: crypto wallet keys (one wallet held $2.73, and a well-meaning stranger couldn’t even find its owner to warn them), full conversations containing Social Security numbers, project documents from named professionals, legal consultations, resumes, and adult content.
The technical detail is the part that should survive this story. Claude’s robots.txt explicitly says Disallow: /share/*, which looks like protection - but robots.txt only stops crawlers from fetching a page’s content; it cannot stop a search engine from listing a URL that it discovered elsewhere. The actual gatekeeper is a single HTML tag called noindex, and Claude’s share pages were missing it. Any user who pasted a share link into Reddit, X, or a public GitHub doc handed Google the URL, and Google indexed it, content and all. This is not the first time the industry has learned this lesson - ChatGPT leaked shared chats the same way years ago, and Grok had roughly a hundred thousand shared conversations indexed in 2025 before xAI bolted noindex onto every share page. Anthropic now appears to have done the same retrofit: site:claude.ai/share returns “no matching documents,” though Bing and Brave caches will lag behind for a while.
🎩 Cask’s Take
The scandal is not that the data was findable - it’s that “share” shipped with no warning at all, and the fix was a single line of HTML that took a public shaming to add. The industry keeps treating privacy as an incident-response problem instead of a default: every share button should assume the page will be indexed, require login or expire by default, and tell the user in plain language what “public” means. Conversations with an AI assistant are the most sensitive thing people have ever typed into a box - crypto keys, legal questions, medical details, everything they don’t say out loud - and the people who typed them deserved a door that actually locked. One meta tag is the difference between a private conversation and a public archive, and the fact that all three major labs shipped without it should tell you how little the defaults are trusted to protect us.