CL-SN55 941 —
GPT-61S 890 +8.8%
GPT-56T 861 —
GPT-6S 847 +1.2%
GPT-56SC 847 +1.2%
CL-OP55X 843 +1.4%
GROK-46H 843 +1.4%
GLM-52 843 +1.2%
DSK-V4PH 843 +1.4%
GLM-5 826 +10.3%
MUSE-SPK 804 —
QWEN-38X 795 +10.1%
GPT-6A 782 +11.1%
CL-FAB5H 761 +1.6%
CL-OP5H 736 +1.7%
CL-OP5X 734 +1.7%
GEM-37FH 732 +1.7%
KIMI-K3X 719 +0.1%
CL-OP46H 719 +1.7%
CL-OP55H 717 +1.7%
CL-OP47H 708 +1.7%
GEM-38FH 689 +0.3%
GPT-56S 581 -0.5%
CL-OP47 546 -0.4%
INKL 531 —
GEM-3P 495 —
CL-OP46 491 —
GEM-31P 487 -0.2%
CL-OP48 484 —
GPT-6L 436 —
CL-SN55 941 —
GPT-61S 890 +8.8%
GPT-56T 861 —
GPT-6S 847 +1.2%
GPT-56SC 847 +1.2%
CL-OP55X 843 +1.4%
GROK-46H 843 +1.4%
GLM-52 843 +1.2%
DSK-V4PH 843 +1.4%
GLM-5 826 +10.3%
MUSE-SPK 804 —
QWEN-38X 795 +10.1%
GPT-6A 782 +11.1%
CL-FAB5H 761 +1.6%
CL-OP5H 736 +1.7%
CL-OP5X 734 +1.7%
GEM-37FH 732 +1.7%
KIMI-K3X 719 +0.1%
CL-OP46H 719 +1.7%
CL-OP55H 717 +1.7%
CL-OP47H 708 +1.7%
GEM-38FH 689 +0.3%
GPT-56S 581 -0.5%
CL-OP47 546 -0.4%
INKL 531 —
GEM-3P 495 —
CL-OP46 491 —
GEM-31P 487 -0.2%
CL-OP48 484 —
GPT-6L 436 —
← Back to feed

A Missing noindex Tag Let Google Index Claude Shared Conversations, Exposing Medical and Company Data

A Reddit user’s search query, site:claude.ai/share, returned hundreds of other people’s Claude conversations. The exposure was real: medical information, school materials, employee documents, and internal company content were accessible via Google search, without any login required.

The cause is a single missing line. Anthropic’s share feature generates public URLs for Claude conversations and Artifacts: interactive apps, dashboards, or documents built inside Claude. Free, Pro, and Max users can create these links and share them externally. When they did, those pages became discoverable by Google.

Why robots.txt Wasn’t Enough

Anthropic had blocked crawlers through robots.txt, which instructs well-behaved bots not to crawl claude.ai/share. That’s standard practice. The problem is that robots.txt is a crawl directive, not an index directive.

Google can still add a page to its index when it encounters a link to that page from outside the restricted domain: a tweet, a blog post, a forum. The page appears in results because Google learned of its existence from the external link, not by crawling claude.ai. To prevent indexing of externally-linked pages, each page needs a noindex meta tag in its HTML, which tells search engines to exclude it from results regardless of how they found it.

Anthropic’s share pages lacked that tag.

Scope of the Exposure

Indexed pages included medical records and internal company materials. The volume of exposed conversations is unquantified. Shared links are created voluntarily, and the exposure only affects conversations or Artifacts for which users explicitly generated a public URL and then shared that URL somewhere indexable.

Unshared conversations are private. The issue does not affect conversations that were never turned into share links. Anthropic says it does not submit share page directories or sitemaps to search engines, and that links only become discoverable after users distribute them externally.

Remediation

Anthropic has now added the noindex directive. The fix is one HTML tag. Users who created share links can review and revoke them under Settings > Privacy > Shared chats.

The structural issue is that a feature designed for “anyone with the link can view” conflated URL-based access control with search invisibility. The two are not equivalent. A URL that works only if you have it is not the same as a URL that won’t appear in search results. Fixing that gap requires page-level controls that were absent at launch.