Claude Makes Five AI Labs Publishing Private Chats To Google

Think about all the chats you’ve ever shared with someone. A diagnosis you were trying to understand before the appointment, a contract clause you didn’t want to bill a lawyer for, a message to your ex you rewrote four times. You hit the share button, and it sends a link. It also publishes a page.

Last weekend some of those pages turned up on Google: medical reports, clinical-trial results with patient names, documents listing the names and phone numbers of primary-school children. By Monday afternoon they were gone, remediated inside roughly 48 hours.

Anthropic is the fifth major AI lab to do this. Google’s Bard chats reached search results in September 2023; Meta built the same confusion directly into its AI app, and in June 2025 users published intimate conversations to a public Discover feed, often without understanding where the share action led. OpenAI’s opt-in checkbox put about 4,500 ChatGPT conversations into Google that July, and xAI’s share button published more than 370,000 Grok chats a few weeks later, a set that included instructions for making fentanyl and a plan to assassinate Elon Musk. Those were different mechanisms, but same result.

There’s a layer of the AI stack nobody publishes a safety framework for. Regulators haven’t written a rule aimed at it and no system card mentions it. It’s the button that turns a conversation into a web page, or as it should be called — a publish button.

Two Instructions That Cancel

Anthropic didn’t overlook search engines. That’s just the thing.

A site can leave instructions for Google’s crawler — the program that travels the web, opening pages and recording what it finds — in two places. One is a file at the front of the site listing the areas to stay out of. The other sits inside the page itself and says the crawler may look, but must not list the page in search results.

Claude carries both: The front-of-site file, robots.txt, tells every crawler to keep off the share path. The share pages themselves return the do-not-list instruction, an X-Robots-Tag header set to none. I confirmed both on July 29, 3 days after the incident.

Read together, the second instruction can’t survive the first. Google’s own documentation is clear about the trap: the do-not-list instruction only works if the crawler opens the page and reads it. The front-of-site file stops it opening the page — which can leave Google free to list an address it found somewhere else, having never seen the instruction not to.

Of course, what that doesn’t establish is cause. No one outside Anthropic can say whether Google reached these pages before the block went up, or when the do-not-list instruction was added — months ago, or on Monday as the repair. What’s verifiable is the configuration: two instructions that don’t work together, on the pages Anthropic publishes.

Anthropic’s account is that it doesn’t give search engines chat directories or sitemaps, and that share links are “not guessable or discoverable” unless people choose to share them themselves. Both are accurate, but neither describes what happened. Nobody guessed a URL, and a crawler doesn’t need a sitemap to follow a link someone posted.

None of this leaked a conversation. It leaked addresses, and every share page stays fully readable to anyone holding the link, under a title Claude wrote and the sharer’s first name — in two places.

And Anthropic has been here before. When Forbes reported roughly 600 indexed Claude conversations last September, the company said it had blocked crawlers. That block was still in place last weekend, but whatever else it did, it didn’t keep the pages out of Google.

Deindexing Is Not Deletion

Anthropic’s exposure cleared within roughly 48 hours, and by Monday afternoon the queries that had surfaced the chats returned nothing.

Deindexing removed the results, not the pages. TechRepublic found individual Claude links already circulating elsewhere still live and reachable. Google stopped advertising the pages, but anthropic kept serving them.

And an address, once found, can be copied. When Fast Company ran a search during the ChatGPT exposure in July 2025 it counted about 4,500 conversations. Days later 404 Media reported that a researcher had already scraped close to 100,000. The search box was showing roughly one in 20.

Which is why nobody can say how large last weekend’s exposure was. Google was the only scoreboard, and it was wiped in less than 2 days.

Who Audits The Publish Button

Nathan Lambert is a computational scientist at the Allen Institute for AI. He used Grok to summarize his own blog posts for his team, and found out from Iain Martin’s reporting for Forbes that the exchange was indexed on Google. If someone who studies these systems for a living misreads the button, the button is the thing worth looking at.

When Google launched Bard’s sharing feature it encouraged users to post conversations to social media, which is precisely how a crawler discovers a share URL in the first place. Claude’s share page ends with a button inviting whoever lands there to ask Claude a question of their own. These pages are built to travel and to convert — That’s literally the specification.

So the publish button ships like a growth feature and gets audited like nothing at all. Labs publish system cards, capability evaluations, red-team results and frontier safety frameworks. All of it measures what the model says, while none measures what the product republishes, or to whom.

The fix existed before the problem did. In September 2023, the day after Bard’s chats surfaced, developer Simon Willison pointed out that OpenAI was already serving ChatGPT’s shared pages with a robots meta tag that kept crawlers off them. The control was named in public, along with the company getting it right. Google then blocked Bard’s share path in robots.txt, the weaker route. OpenAI shipped a discoverability checkbox and produced its own exposure two years later. Anthropic now serves the correct header behind a block that stops it from being read.

The answer has been sitting in a public post since September 2023. Every lab that followed has had three years to read it.