Claude Chats That Leaked to Google Still Live On GitHub

Google and Bing spent the weekend indexing hundreds of shared Claude conversations, exposing medical records, internal company files and resumes before Anthropic scrambled to shut the gap down. The leak surfaced after a Reddit user ran a simple search operator, site:claude.ai/share, and watched private-seeming chats pour into the results. Google’s own count put the damage at just under 600 conversations.

Clearing a search index does not scrub the internet. Copies of the same conversations already sit somewhere Anthropic cannot reach, a problem that outlasted nearly identical leaks at OpenAI and Elon Musk’s xAI over the past year.

What Showed Up When Reddit Typed a Search Operator

A Reddit user first spotted the gap on Saturday, July 25, running a search that limits results to a single web address pattern. What came back were pages Claude users had generated with the platform’s Share button, meant to hand a single conversation to one recipient, not to the open web. Both Google and Bing had the pages indexed, though nearly all of the reporting that followed focused on Google’s results.

404 Media, a tech and security news outlet, confirmed the exposure Monday morning, and TechCrunch verified it within hours. Journalists digging through the indexed pages found a real patient’s medical report and named participants from clinical trial data. At least one document listed the names and phone numbers of primary school children, according to a review by the tech outlet Futurism.

Internal-only corporate files and employee reviews with personal details about staff turned up too, alongside resumes, API keys and stray personal prompts nobody expected strangers to read.

One exposed chat, labeled as shared by Anthropic itself, showed Claude generating sexually explicit material, a breach of the company’s own usage policy, Fortune reported. Exposed Artifacts, the interactive documents and code Claude builds inside a conversation, were readable in full as well.

The Setting That Canceled Itself Out

Early accounts framed the problem as a missing safeguard, as if Anthropic, the AI company behind Claude, had simply forgotten to add a noindex tag. A direct check of the live pages on July 27 found something messier.

• Noindex tag – an instruction placed in a page’s code or server header that tells a search engine not to list that page in results, even if the page itself stays publicly reachable.

Search Engine Journal, a trade publication covering search engines, inspected the response headers on Claude’s share pages and found an X-Robots-Tag set to none, the header equivalent of a noindex instruction. That should have kept the pages out of Google’s results entirely. Instead, Anthropic’s robots.txt file was already blocking crawlers from reaching those same pages. A crawler that cannot open a page cannot read the instructions written inside it.

Google’s own guidance says as much: a noindex signal only works if the crawler is allowed in to read it. Block the crawler and the two safeguards cancel each other out. The result was a page invisible enough to keep Google from crawling its contents, yet public enough for anyone holding the link, or finding it reposted anywhere else on the web, to open it in full.

Three Chatbots, Three Leaks in Twelve Months

Claude is not the first major chatbot whose Share button doubled as an unintentional publishing tool. Around the same time last year, OpenAI, which makes ChatGPT, disabled the shared chat discoverability toggle after its own conversations turned up in Google. A few weeks later, Elon Musk’s xAI saw 370,000 Grok chats become indexed and searchable on Google.

Each case traced back to the same blind spot: a link built for one recipient turned into a page anyone could crawl. Anthropic’s numbers were the smallest of the three by a wide margin. The fix still could not outrun what had already been copied elsewhere.

Does Pulling a Page From Google Erase It?

No. Removing a page from Google’s index only changes what the search engine displays. It does nothing to copies already made by other crawlers, archiving tools or people who saved the content before the fix landed, which is exactly what happened with Claude’s exposed conversations this week.

Decrypt, a technology news outlet, reported that one archive alone had already mirrored 11,241 of the exposed messages to GitHub before Anthropic closed the gap. That copy answers to GitHub’s own policies, not to Anthropic’s index settings, and nothing in the public reporting suggests it has come down.

The pattern already has a year-long paper trail. Internet Archive’s snapshotting tool captured chunks of the exposed ChatGPT conversations back in 2025, and separate trackers counted well over 100,000 of those copies once archived pages were added to the tally. OpenAI never confirmed a final number, and there is no public record of those archived copies being removed since.

Claude’s exposure was tiny next to Grok’s or ChatGPT’s. It still took just one archive to make part of it permanent.

Who Answers When Someone Else Shared Your Data

Google’s position is that it only reflects what is already public. Ned Adriance, a Google spokesperson, told TechCrunch that search engines do not decide what content becomes public, and that keeping a page out of results is a site owner’s job once they publish technical directives like noindex tags.

Anthropic’s position is similar. The company told TechCrunch the exposure was not a bug or a data breach, but the intended behavior of a Share feature never designed to broadcast conversations to search engines. Claude chats stay private by default, and Anthropic does not publish directories or sitemaps of user conversations, the company said.

Both statements are defensible. Both also skip past the same person: whoever’s name, phone number or medical history ended up in a chat they never clicked share on. A school child whose essay was posted for feedback did not agree to anything. Neither did the patients named in a clinical trial file, or the employees described in a colleague’s performance review.

It is the same crawler-first, publisher-second logic playing out in a separate fight, where Reddit and news publishers are weighing whether to block Google’s AI crawlers outright over lost traffic. In both cases, the search engine’s default is to crawl and index everything technically reachable, leaving the burden of opting out on whoever built the page.

What We Know:

• Google’s count: just under 600 conversations were indexed before the pages disappeared from results, per Google’s own estimate to TechCrunch.
• The technical cause: a robots.txt block prevented Google’s crawler from ever reading a noindex header already present on the pages, according to Search Engine Journal’s direct check.
• The timeline: a Reddit user flagged the issue Saturday, July 25; 404 Media confirmed it Monday morning; Google’s results had largely cleared by Monday afternoon.

What’s Unconfirmed:

• How many shared links were ever publicly reachable in total, beyond the roughly 600 Google happened to crawl.
• Whether Anthropic will seek removal of the GitHub archive or any other third party copies.
• How much of the same content Bing, which also indexed the pages, has removed, since most public accounting has focused on Google.

How to Check if Your Shared Claude Chats Are Still Public

Anthropic points worried users toward a specific settings path. It takes about a minute to check.

• Open Claude and go to Settings, then Privacy, then Shared Chats, where every link you have ever created is listed.
• Review each entry. A conversation appearing there is a live public page right now, not a private record sitting quietly in your account.
• Revoke access on anything you do not want reachable anymore. This removes the page going forward and stops new crawlers from finding it.
• Do not assume revoking undoes the past. If a link was already copied to an archive, a forum post or a GitHub repository, unsharing it in Claude will not touch that copy.

Google’s results for claude.ai/share had cleared by Monday afternoon, and Bing’s followed soon after. What is already sitting in a GitHub repository, or wherever else a stranger saved it first, answers to nobody’s settings menu.