PSA: Your Claude shared chats and Artifacts may have ended up on Google
An untold number of Claude chats and Artifacts — the interactive mini apps and documents users can build inside Claude — were found publicly searchable on Google over the weekend, after Reddit users discovered that typing search operators like “site:claude.ai/share” into Google surfaced a long list of shared conversations.
A privacy story dressed as a PSA. Anthropic's Claude "share" feature was designed to let users send a conversation to a colleague with a link. The fine print, as ever, was less generous than the marketing. Those links were not gated behind authentication, and Google indexed them. The result: medical histories, legal drafts, and proprietary code rendered as plain text in a search bar.
The mechanics here are worth understanding. A "share" button is a publishing tool with a friendly name. When the resulting URL is crawlable, the user has effectively published to the open web, whether they intended to or not. Anthropic's interface did not make this distinction visible. The platform absorbed the trust; the user absorbed the risk.
Reddit users found the trove using a site operator query. That detail matters. The exposure was not the work of sophisticated actors. It was discoverable by anyone with a keyboard and a working knowledge of search syntax. The barrier to entry was zero, which means the window of exposure was almost certainly wider than the indexed results suggest.
Anthropic's response will determine whether this becomes a footnote or a precedent. A quiet patch and a blog post will not suffice. The company needs to demonstrate that shared links are now off by default, that previously indexed content has been purged from search caches, and that the underlying indexing permissions have been fundamentally reworked. Anything less signals that user data remains a secondary concern behind growth metrics.
The broader lesson is structural. Every "share" button in every AI product is a potential data leak waiting for a search engine to notice. Until platforms treat public-by-default sharing as a failure state rather than a feature, this category of incident will repeat, with different logos and the same outcome.