One Google Query Surfaced Shared Claude Chats Again. robots.txt Was Never Going to Keep Them Out.

TL;DR

Over the weekend, users on r/ClaudeAI noticed that searching site:claude.ai/share on Google returned page after page of shared Claude conversations: legal questions, engineering troubleshooting, proprietary code, resumes, and, by several accounts, credentials and crypto wallet details. Anthropic's share pages vanished from Google results by Sunday, though the company had not publicly commented as of this writing, per GBHackers and IBTimes. This is the second time Claude share links have surfaced in search since September 2025, and the third such incident industry-wide since ChatGPT's in August 2025. The root cause is boring and unchanged: a share link is a public URL, and robots.txt blocks crawling, not indexing.

A search query, not a breach

Nobody hacked anything. When you click Share in Claude, Anthropic generates a snapshot of the conversation at a public URL under claude.ai/share/. Anyone holding the link can read it; that is the feature working as designed. What changed this weekend is discoverability: a single site: operator turned "anyone with the link" into "anyone with Google."

What was sitting in those results is the uncomfortable part. Reports describe legal strategy discussions, debugging sessions over proprietary code, CVs, internal company files, and chats containing access keys and wallet data, per BeInCrypto. The same report carries an honest caveat worth repeating: nobody has publicly confirmed a working key or seed phrase in the indexed chats, and no stolen funds have been reported. Counts are equally soft; outlets say anywhere from hundreds to thousands, and Reuters could not verify a number before Google scrubbed the results.

One telling detail: some Google listings reportedly showed the URL with the message "No information is available for this page." That is the signature of a URL Google indexed without ever crawling it. The full conversation was still one click away, because the page itself requires no authentication.

robots.txt is a sign, not a lock

Anthropic does try to keep these pages out of search. Its robots.txt disallows crawling of share pages, and the company provides no sitemap or directory of them. The catch is that robots.txt governs crawling, not indexing. Google's own documentation says it plainly: do not use robots.txt to hide pages from search results, because "if other pages point to your page with descriptive text, Google could still index the URL without visiting the page."

Think of robots.txt as a "please don't come in" sign on an unlocked door. Google honors the sign and never steps inside, which also means it never sees any noindex note taped to the wall in the hallway. If someone else publishes your address, Google still lists the house. It just can't describe the furniture, and it doesn't need to, because the door is unlocked for anyone who walks up.

That interplay is why the two fixes people keep suggesting cancel each other out. A noindex tag only works if crawlers are allowed to fetch the page and read it; blocking the crawl in robots.txt guarantees they never will. The only real controls are authentication on the page or not creating a public URL in the first place. Everything else is etiquette.

Third time in twelve months

The industry has now shipped this exact incident on a roughly annual cadence, except the gap is shrinking. ChatGPT went first: in late July 2025, shared conversations that users had marked "discoverable" via an opt-in checkbox started appearing in Google. OpenAI called the feature a short-lived experiment that created too many chances to accidentally overshare, and killed it within days, then worked with search engines to scrub the results.

Claude's turn came in September 2025, when Forbes found just under 600 Claude transcripts in Google's index. Anthropic told Forbes: "We give people control over sharing their Claude conversations publicly, and in keeping with our privacy principles, we do not share chat directories or sitemaps of shared chats with search engines like Google and actively block them from crawling our site." The company's explanation was that users had posted the links publicly themselves; Forbes interviewed at least one user who disputed ever doing so. The 2025 batch also included prompts from Anthropic's own team, among them a request for a "comedy Anthropic office simulator," which at least demonstrates a commitment to dogfooding.

This weekend's wave looks like the September incident at larger apparent scale. The Decoder reports that Google results disappeared quickly once the Reddit thread took off, while Bing and Brave Search kept serving the pages for longer. Whether the trigger was share links posted publicly, a crawler ignoring the sign, or something on Anthropic's side is exactly the question the company has not yet answered.

What to do about it

If you have ever clicked Share in Claude, audit it now. The Decoder points to the list under Settings, Privacy, Shared Chats; revoke anything stale, and everything you don't recognize. Treat any secret that ever appeared in a shared conversation as burned and rotate it: API keys, tokens, wallet material, customer data. The safe mental model is that a share link is an unlisted public webpage, because that is literally what it is.

Two sharper edges for teams. First, deindexing is not deletion: GBHackers notes that cached copies, archived pages, browser histories, and reposted links can outlive the search results, so a scrubbed index does not un-expose anything. Second, if your org uses Claude for real work, share links deserve a line in your security policy next to pastebins and public gists, and for the same reason. The transcript of a debugging session is often the most sensitive document your team produces all week; it has your architecture, your bugs, and occasionally your credentials in one scrollable page.

Key Takeaways

• Shared Claude conversations were discoverable on Google this weekend via site:claude.ai/share, first flagged on r/ClaudeAI; results were scrubbed by Sunday, and Anthropic has not yet commented.
• Exposed chats reportedly included legal, code, and business content, plus credentials and wallet details in some accounts; no working key or theft has been publicly confirmed.
• The mechanism is structural: robots.txt blocks crawling, not indexing, and Google will list a blocked URL that other pages link to. A noindex tag cannot help on a page crawlers are forbidden to read.
• This is the third incident of its kind since August 2025, after ChatGPT's discoverable-chats experiment and the roughly 600 Claude transcripts Forbes found in September 2025.
• Audit your shared chats, revoke stale links, and rotate any secret that ever touched a shared conversation; deindexing does not undo exposure.
• Only authentication or not publishing a URL keeps a page private. Everything short of that is a polite request to crawlers.

Sources: The Decoder, Forbes, Search Engine Land, GBHackers, BeInCrypto via Yahoo Tech, Google Search Central