Public Claude Chats Turned Up in Google Search Results

Bruce Schneier drew attention to a story that can hardly be called rare in the age of chatbots: some conversations with Anthropic's Claude assistant turned out to be accessible through an ordinary Google search. The problem lies not so much in a leak in the technical sense as in exactly what ended up out in the open.

What exactly surfaced

Among the indexed material were a psychotherapist app — apparently thrown together in a “vibe coding” style — notes from work meetings, and a dashboard someone built to analyze medical-billing data. In some conversations, according to reports, private keys to cryptocurrency wallets turned up, along with personal information such as people's home addresses. In other words, data whose public exposure can translate into direct financial losses and the breach of someone else's privacy.

The root of the problem is a user setting that governs the publication of a conversation. When a person turns on the “share” feature, the conversation gets a link and effectively becomes a publicly accessible web page.

Anthropic's position

The company took a pointedly detached stance: this isn't its problem. In a statement it said that users are given control over public access to their conversations, and that Anthropic itself, “in keeping with its privacy principles,” does not hand search engines like Google any chat directories or sitemaps. The links, according to the company, cannot be guessed or discovered — unless the owner shares them himself. And once a person has clicked “share,” he makes the content public, and, like any other open web content, it can be archived by third-party services.

The logic is, without a doubt, legally sound. The only trouble is that the average user, judging by the contents of the surfaced conversations, has a poor grasp of the consequences of a single click. Between “sharing a link with a colleague” and “posting a private key into a search index” there lies, for many, a chasm that the interface evidently failed to make clear.

Schneier accompanies his note with a brief remark and a link to instructions on how to disable unwanted publication. The takeaway from the story is simple and by now familiar: before entrusting a chatbot with keys, addresses, or medical details, it's worth remembering that the “share” button sometimes means “share with the entire internet.”

Source: Schneier on Security