In September 2025, Anthropic had a documented Claude share-page search-indexing failure on its hands. Google had indexed just under 600 shared Claude conversations, according to Forbes, which reported the incident on September 8. These weren’t ordinary unshared chats, but public snapshots created by Claude’s Share feature. The first warning was documented in public.
Then, 322 days later, Claude did it again. In July 2026, a fresh set of shared Claude pages turned up in Google and Bing, as TechCrunch and WIRED reported. The dates matter because the second incident wasn’t an isolated surprise. It was a recurrence at the same company, involving the same basic product boundary, less than a year after the first warning.
The reporting doesn’t describe a breach of private accounts, a hack, or a database dump. It describes a product design failure. But the recurrence adds an accountability failure: Anthropic ended up back in public reporting exactly 322 days later. I think accountability starts with treating the second incident as recurrence, not as an event from nowhere. Treating it as isolated would reset the accountability clock and make a recurrence look like a first offense.
What actually happened#
Consumer Claude chats are private by default. That part works. The trouble starts with the share button.
When you share a Claude conversation, Anthropic’s servers create a public web page at a URL like claude.ai/share/something-unique. That page contains your conversation up to the moment you clicked share: messages, Artifacts (the code and text snippets in the chat), and anything the model generated. The Anthropic documentation says anyone with the link can view that snapshot, though the underlying attached file itself isn’t included.
But “anyone with the link” turns out to be a broader category than most people expect. A unique URL isn’t a private one. If that URL appears somewhere a search engine can find it, a crawler can follow the link. And because the Claude share pages WIRED inspected didn’t include the noindex meta tag that tells search engines to stay out (WIRED confirmed that in July 2026), the crawler can index the content.
Google’s own documentation explains why this matters. Blocking crawlers with robots.txt doesn’t prevent indexing when a page is linked from other places. You need a page-level instruction. The Claude pages WIRED inspected had the block but not the instruction.
That’s how you end up with two Claude incidents in under a year.
This is bigger than Claude#
The same pattern has played out across the industry with remarkable consistency.
Google’s Bard had shared chat pages indexed in September 2023. Google said it didn’t intend those chats to appear in search and was working to block them, as The Register reported. ChatGPT had an explicit “make this chat discoverable” checkbox inside its share flow, which OpenAI removed in August 2025 after shared pages appeared across Google, Bing, and DuckDuckGo. xAI’s Grok had hundreds of thousands of conversations indexed that same month, according to Forbes.
Four products. Same pattern. In each case, a share feature created a public page without making the action feel like publication.
The part we don’t know#
Anthropic says crawlers encountered these URLs because users shared them in public places. That explanation covers the straightforward cases: someone posts a Claude link on social media or a forum, a crawler finds it, the page gets indexed.
But it doesn’t cover every case. In the September 2025 incident, Forbes documented one affected user whose work-related transcript appeared in search. That user said they hadn’t posted the conversation online. That contradiction remains unresolved. It matters because we still don’t know whether that case fits Anthropic’s explanation.
Why the interface matters#
Think about what people put in these chats: work drafts, personal questions they wouldn’t type into a search engine, and documents they upload for help. Sharing one useful exchange with a colleague or friend can expose the rest of the snapshot too. And that share action looks like the ones they’ve used elsewhere for years.
You click share, get a link, and send it to one person. The mental model is one-to-one delivery.
The technical reality is one-to-anyone access. A public web page with no access control, protected only by the obscurity of its URL.
That gap between the mental model and the technical reality is the design failure. An interface that feels like handing someone a note shouldn’t behave like posting to a public billboard. When the two actions look identical, people will treat them the same way. And some of those people will be surprised when a search engine serves their work draft, their personal question, or details from an uploaded document to someone they never sent it to.
This isn’t about users being careless or naive. It’s about interfaces that borrow the visual language of private communication for what is actually a public act. If the button said publish, not share, fewer people would be surprised by the result. But it doesn’t say publish. The word share makes the action feel frictionless in a way publish doesn’t. And frictionless sharing is frictionless publishing, whether the UI admits it or not.
What you can do#
If you use Claude’s consumer product, the practical step hasn’t changed since last September. Open Settings, go to Privacy, then Shared Chats. Review the list. Anything that shouldn’t be public needs to be unshared. If you use other assistants, review their shared-link controls too.
Treat shared conversations the way you would treat a blog post. Unsharing stops future access, but a shared conversation, like other public web content, may be archived by third-party services. That’s the nature of publishing, and sharing is publishing whether the interface says so or not.
The practical advice matters, but it can’t be where accountability ends. The September 2025 incident involved just under 600 indexed Claude conversations and was publicly reported by Forbes on September 8. Anthropic had exactly 322 days before TechCrunch and WIRED reported Claude share pages in search again. We don’t know the exact route each URL took to a crawler or every technical change Anthropic made between reports. We do know the warning was documented in public.
The industry has now run this experiment across Bard, ChatGPT, Claude, and Grok: four products over three years. The details differ, but in every case, discovery came after a public snapshot had already become searchable. The pattern will keep repeating until product teams design for the reality that a shared URL is publication. A unique string of characters isn’t a privacy boundary. It never was.
Calling a share a publish would at least name the act honestly. Remembering the first failure when the second one arrives would name the accountability honestly, too.
Treating repeat failures as new surprises resets the accountability clock. Claude’s two publicly reported incidents were exactly 322 days apart. The question now isn’t how this happened once. It’s why a documented warning was followed by a sequel before a year had passed.