Hundreds of Shared Claude Chats Turned Up in Google Search, API Keys and Resumes Included

The private AI chat you shared with one colleague was sitting in Google, resumes and API keys included

On July 25, 2026, a Reddit user showed that a single search, site:claude.ai/share, pulled up hundreds of conversations people had held with Anthropic's Claude assistant and never meant for strangers to read. Roughly 600 shared chats and interactive Artifacts were sitting in the open. Among them were resumes carrying real names and phone numbers, live API keys, crypto wallet details, a lawyer's notes on a possible ethics case, and text that looked like Social Security numbers.

Nobody broke in. No password was phished and no malware ran. The share feature did precisely what it was built to do, and that is what makes this worth your attention. The leak was an ordinary product working as intended, colliding with a search engine that was only doing its job.

What happened

When you share a Claude conversation, the assistant creates a public link on the claude.ai/share path. Anyone holding that link can open the chat with no login. The pages carried no noindex tag, the small piece of HTML that tells a search crawler to skip a page. So once a share link leaked into a forum post, a public code repository, a social feed, or a screenshot, Google and Bing were free to crawl the full contents and file them under a searchable address. The site: operator, which limits a search to one domain, did the rest.

The mechanism is almost banal, and that is the point. A share link is not a secret. It is a URL, and URLs get copied, pasted, and posted. The missing noindex tag meant every one of those escaped links became a candidate for the search index. Researchers pulling the results found AWS Access Key IDs, the credential that unlocks an Amazon cloud account, and a Replicate API token sitting among the personal documents. Anthropic responded within days, updating its robots.txt file and related controls, and the Google results were cleared by around July 28. Bing lagged behind.

• About 600 shared conversations and Artifacts were indexed, surfaced by the plain search operator site:claude.ai/share.
• Exposed material included resumes with names and phone numbers, AWS and Replicate API keys, crypto wallet details, financial spreadsheets, a lawyer's notes on an ethics matter, and apparent Social Security numbers.
• Removing pages from search does not kill the links. Anyone who already saved or bookmarked a share URL can still open it unless the share is revoked at the source.

Why it matters

The concrete harm is that real people's identities and working credentials were left where anyone could find them, and a live API key in a search result is an unlocked door a stranger can walk through long before the owner notices. For your organisation, the exposure is closer than it looks. Think about why people share an AI chat in the first place: to hand a colleague a draft, to get a second opinion on a config file, to show a vendor how a script failed. Those are exactly the conversations that carry client names, internal data, and the occasional pasted secret. If someone on your team shared one to collaborate, the link may have been crawlable, and because a saved URL outlives the fix, you cannot assume the problem ended when the search results did.

The wider shift is the one to carry into a meeting. This is less a Claude flaw than a pattern. Publicly shareable links from AI tools were indexed by Google when the same thing happened to ChatGPT in July 2025, and again here a year later. Every assistant that ships a friendly share button is quietly turning private conversations into public web pages, and search engines will keep finding them.

What to do about it

1. Audit and revoke your existing shared links now. In Claude's settings, review every conversation you have shared and delete the ones you no longer need, because removal from Google does nothing for a URL someone already saved, and only revoking the share itself closes the door.
2. Treat any AI share link as public the moment you create it. Never paste an API key, a password, a client name, or a personal record into a chat you might share, because a share link is just a URL and URLs travel, so the only reliable control is keeping secrets out of the conversation to begin with.
3. Give staff a sanctioned way to share AI output, and put it in policy. Offer an internal, access-controlled method such as a private workspace or a document, and tell people not to use public share links for work content, because informal sharing stays invisible to you until it surfaces in a search result.

Bottom line

No attacker was needed here. A convenience feature turned private chats into public web pages, a search engine indexed them, and a simple query did the rest. Anthropic's fix was quick, but the durable lesson is about your own habits. Anything you share from an AI tool should be treated as if it could appear in a search result tomorrow, because on more than one platform now, it already has. Before your team leans harder on these assistants, it is worth asking who at your company has shared a Claude or ChatGPT conversation this year, what was in it, and whether those links are still live.