404media.co web signal

Claude shared chats leak wallet keys, medical data via Google

By Published Updated
7 sources tracking this story
anthropic cybersecurity ai-business

TL;DR

  • A missing noindex tag is the root cause, the same omission behind ChatGPT's 2025 indexing incident that exposed roughly 100,000 conversations.
  • A GitHub repository archived 11,241 exposed messages before Anthropic's fix, making the breach permanent regardless of platform-side remediation.
  • Anthropic's Google-side fix landed within hours, but Bing and Brave Search results persisted longer, exposing an uneven remediation window across search engines.

A batch of Claude conversations and Artifacts that users had shared via public links turned up in Google search results, and the material inside them was exactly the kind of thing you would not want strangers to find. According to 404 Media, Joseph Cox reports the exposed pages included cryptocurrency wallet keys, API keys and login credentials, personal information like names, addresses and phone numbers, an AI-powered therapy app that someone appears to have vibe-coded, notes on meetings, and a dashboard someone made apparently to analyze medical billing data.

The mechanism is a Google dork, which the piece defines as a super specific search that is useful for finding particular webpages or files. One dork surfacing Claude chats appears to have been mitigated by the time 404 Media tested it on Google and DuckDuckGo. A second dork, targeting Claude's Artifacts feature, the interactive workspaces where people run vibe-coded apps and other tools, was still returning results at publication.

The reason this reads familiar is that OpenAI already lived through it. 404 Media notes the incident is similar to a ChatGPT exposure last year in which conversations were searchable on Google, and that a researcher was able to scrape those exposed chats. Whatever lesson that round taught did not propagate cleanly. Anthropic did not immediately respond to a request for comment.

The honest caveat is that the reporting does not give you a count of how many Claude pages were actually indexed, whether Anthropic is proactively notifying affected users, or how the second dork slipped past whatever mitigation closed the first. And once material is out, it is out. Third parties may already have scraped these pages, which means a page vanishing from Google now does not undo the exposure.

What is worth watching is whether Anthropic, and the rest of the AI product surface that ships a share button, starts treating public sharing as a security boundary by default. That looks like noindex on shared pages, a warning before a user pastes a secret into a chat they intend to share, and clearer language about what public actually means. Until then the same failure mode is likely to recur on the next product with a share link.

What others are reporting

Coverage cluster as of 24h after publish

  1. TechCrunch Read →

    Anthropic spokesperson on record attributing exposure to user choice rather than platform design; documents children's contact info and a prior similar Anthropic incident.

    When someone shares a conversation, they are making that content publicly accessible, and like other public web content, it may be archived by third-party services.
  2. Fortune Read →

    Situates the incident as a three-platform failure spanning ChatGPT, Grok, and Claude; notes users treat AI chatbots as private spaces for health, legal, and financial matters.

    These shareable links are not guessable or discoverable unless people choose to share them themselves.
  3. Futurism Read →

    Documents the gap between Claude's sharing UI warning and the undisclosed consequence of search indexing; identifies clinical trial patient data and a Forbes-investigated edge case.

    shared content could wind up being indexed by a search engine — meaning a user could effectively be sharing their Claude-generated document with the entire internet.
  4. Decrypt Read →

    Reports the GitHub archive of 11,241 messages that survived Anthropic's fix; specifically documents crypto wallet seed phrases and unreleased product roadmaps in the exposed set.

    A missing line of code meant 'share with a link' and 'searchable by anyone' were the same thing
  5. The Decoder Read →

    Most technically precise account: names the missing noindex meta tag as the exact failure point, and tracks remediation unevenness across Google, Bing, and Brave Search.

    The 'Share with link' feature apparently lacked a `noindex` tag, which tells search engines not to include pages in their results.
  6. Protos Read →

    Extends the story past Anthropic: after Claude's data was de-indexed, Perplexity's equivalent public-sharing directory remained live, showing no coordinated cross-platform response.

    Current searches return zero results for Claude while an equivalent query for Perplexity returns pages of listings.

Shared on Bluesky by 4 AI experts

Originally reported by 404media.co

Read the original article →

Original headline: 404 Media: Shared Claude Chats and Artifacts, Including Wallet Keys and Medical Data, Indexed by Google