A Reddit user found that Google had indexed shared Claude conversations, and Futurism turned up what appeared to be a real patient's medical report, clinical trial results with patient names, and documents listing the names and phone numbers of primary school children. Anthropic says users made those pages public. Search Engine Journal found a noindex header sitting behind a robots.txt block, a configuration that stops Google from ever reading the instruction.

On Saturday, July 25, someone posted to r/ClaudeAI with an observation and a search string.

One search operator, the ordinary kind that narrows results to a single path on a single domain, returned a long list of other people's conversations.

By Monday morning, 404 Media had the story, which TechCrunch credits as the first report on it. Futurism, working the same thread, listed what it turned up: "what appeared to be a detailed medical report of a real patient, clinical trial results that included patient names, documents sharing the names and phone numbers of primary school-aged children, company documents marked for internal use only, and employee reviews that included personal information about workers."

That hedge is doing real work, and it belongs in any honest retelling. Cybernews narrowed the gap a day later, reporting that it viewed an indexed clinical trial document listing patients' full names, ages, genders, ethnicities, skin types and treatment dates.

Nobody broke into anything. There was no exploit and no compromised server. Those pages existed because someone had clicked "share" to create a public link for them.

The Feature Worked Exactly as Built

Claude's share feature generates a public URL for a conversation or project. The interface says "Anyone with the link can view." Artifacts, the documents and small apps users build inside Claude, publish through a separate path and produced a second set of results.

The gap is between what "anyone with the link" sounds like and what it means. TechCrunch's Lorenzo Franceschi-Bicchierai drew the comparison directly: Google Docs offers a similar sharing feature, and in TechCrunch's account those documents do not end up publicly accessible on Google. Most people reading "anyone with the link" hear "the colleague I send it to," not "anyone who types the right search operator."

Exposed Artifacts included working code and internal work notes. In at least one case, Fortune reported finding a chat labeled "shared by Anthropic" in which Claude produced erotica. TechCrunch noted that Anthropic's usage policy explicitly prohibits Claude from generating sexually explicit content, and that the company had not responded to a request for comment on that specific chat.

Disallow Is Not Noindex, and Most Teams Get That Wrong

This is the part worth understanding, because the same misconfiguration is easy to ship and hard to notice.

Search Engine Journal's Matt G. Southern noted that much of the early coverage, including The Decoder, reported that Claude's share pages simply lacked a noindex tag. Southern checked the actual headers on July 27 and found something more specific.

Claude's share pages do return an X-Robots-Tag: none header, which Google treats as equivalent to noindex plus nofollow. They also sit behind a Disallow: /share/* rule in the robots.txt at claude.ai, under the User-agent: * group, with no separate Googlebot group.

Those two controls cancel each other out.

Google's own documentation explains why. A noindex directive only takes effect if the crawler is allowed to fetch the page and read it. When robots.txt blocks the URL, Googlebot never issues the request and never sees the header. If it then discovers that URL from a link anywhere else on the web, it can list the URL in search results without ever having crawled the page.

Southern was careful about the limits of his own reporting, and that caveat belongs here. He could confirm only what the pages served on July 27, after the story broke, not what they served over the weekend when the URLs were first surfacing. Independent IT consultant Daniel J. Glover documented the same conflicting configuration a day earlier, on July 26.

Glover also went to the Wayback Machine and dated the Disallow: /share/* rule to around August 2, 2025. Nobody added that block in a panic over the weekend. It had been sitting there for close to a year, quietly cancelling the header behind it.

Southern's second finding is the one with a loose end attached: the /public/artifacts/ path is not listed in Claude's robots.txt at all.

Axios reporter Sam Sabin, searching separately on Monday afternoon, could no longer surface Claude conversations in Google but was still able to find publicly shared Claude Artifacts indexed. Among them were business plans, infrastructure diagrams for multi-cloud environments, a document on changes to a university's academic calendar, and planning documents describing how a clinical trial could be conducted. Axios noted it could not immediately verify who created each one or whether the contents were real.

Glover checked what that path actually serves, and found the opposite of carelessness. Artifact pages carry a page-level noindex tag in the HTML, and a crawler can read it precisely because nothing blocks the fetch. The artifacts path is the one configured correctly. What Sabin found on Monday is a lesson in how long an already-indexed URL lingers, not evidence of a second misconfiguration.

The generalizable lesson has nothing to do with Anthropic. If you have URLs you want kept out of search results, the noindex directive has to be reachable by the crawler. Blocking the bot and telling the bot to stay away are two different instructions, and issuing both at once means it only ever receives the first.

Anthropic Pointed at Its Users. Google Pointed at Anthropic.

Neither company took responsibility.

"We give people control over sharing their Claude conversations publicly, and in keeping with our privacy principles, we do not share chat directories or sitemaps with search engines like Google. These shareable links are not guessable or discoverable unless people choose to share them themselves. When someone shares a conversation, they are making that content publicly accessible, and like other public web content, it may be archived by third-party services." — Amie Rotherham, Anthropic spokeswoman (TechCrunch, July 27, 2026)

Anthropic's position is that share links only surface in search when a user has posted them somewhere crawlable, and that a link sent privately stays out. That describes one route by which a public URL gets discovered. It sits awkwardly next to the weekend, though: the claim that these links are "not guessable or discoverable" is exactly what a one-line search operator called into question, and the statement does not address the header configuration Southern documented.

Google drew a boundary around its own responsibility.

"Neither Google nor any other search engine controls what pages are made public on the web, and these pages were indexed across many search engines. We give site owners clear controls to decide whether pages can be crawled or indexed, and we always respect those directives." — Ned Adriance, Google spokesperson (TechCrunch, July 27, 2026)

What the two statements describe between them is a failure with no single owner: a product decision, a header, a robots.txt rule and a user's click, each defensible on its own, combining into a stranger's clinical trial data sitting in a search index.

By Monday afternoon, a TechCrunch test search using the method from the Reddit post returned nothing for conversations, suggesting that part of the exposure had been remediated. Artifacts were a different story, and so were other search engines. Glover recorded results still live on Bing and Brave after Google went quiet on July 26.

How durable the Google fix is depends on how it was done. Glover's read is that the speed of it points to Search Console's removals tool, which suppresses URLs for roughly six months rather than deleting them. If that is what happened, and the Disallow rule still hides the noindex header from Googlebot, then nothing underneath has actually changed. It has been paused.

Three Companies Have Now Watched This Happen

This is not a Claude problem. The same failure mode has now hit three of the largest consumer AI assistants.

Incident	When	What was reported
Google Bard transcripts indexed	2023	Google moved to block transcripts from being indexed
Shared ChatGPT conversations scraped	2025	404 Media reported a researcher pulled roughly 100,000 publicly shared conversations
OpenAI pulls shared ChatGPT chats from search	Late July 2025	Feature reversed after chats appeared in Google
Claude transcripts indexed	September 2025	Forbes reported hundreds indexed; Google estimated it had indexed just under 600 conversations
Claude chats and Artifacts indexed	July 2026	No verified count published; TechCrunch called it "an untold number"

The 2026 figure is the one nobody has pinned down. Anthropic has published no count, no postmortem, and no technical description of what it changed or when. Reporters have run tallies of their own in the days since, none of them official and none of them complete. The nearest verified precedent is still the September 2025 Claude incident, at just under 600 conversations.

Same company, same feature, same outcome, ten months apart.

Check Your Shared Links Today

Where to look

Any conversation or Artifact you have not unshared is still reachable by anyone holding the link, whether or not it currently appears in search. In Claude, open Settings, then Privacy, then Shared Chats for the full list of public links on your account.

Four things are worth doing today:

Audit the list, not your memory. People routinely find links in that settings panel they created months ago and forgot about entirely.
Unshare and unpublish separately. Search Engine Journal notes that unsharing a chat kills the direct link, but an Artifact created inside that chat publishes through its own process. Turning off one does not turn off the other.
Understand what unsharing does not do. Killing the link does not pull an already-indexed URL out of Google. Southern's point is that a Claude user has no control over what claude.ai serves to Googlebot, because the domain belongs to Anthropic.
Set a rule for your team. If a conversation contains anything you would not post on a public blog, do not create a share link for it. Paste the text into your own tooling instead.

If your organization runs an internal LLM tool with its own sharing feature, the same audit applies to you: check whether your noindex directives are actually reachable by crawlers, and whether the word "share" in your UI is communicating "publish."

The Bottom Line

The interesting failure here is not any single line of configuration. It is how ordinary each decision was on its own: a share feature that generates public URLs, a warning label reading "anyone with the link," a crawl block that hid the very header meant to prevent indexing, and a search engine doing precisely what its documentation says it does.

Anthropic is right that users made those pages public. Google is right that it does not decide what goes on the open web. A clinical trial record with patients' names attached was still sitting in a search index over the weekend.

We covered a near-identical shape of problem last week, when a developer switched off Grok Build's privacy toggle and watched his codebase upload anyway. In both cases the privacy control existed, sat one layer away from where the data actually moved, and nobody found out until a stranger said so in public. For a broader look at what Anthropic collects from users and why, see our earlier piece on the identity verification it now asks for.

Southern's closing line is the one to keep. "Three companies have now had customer chats turn up in search," he wrote. "That's reason enough to treat a public share link as a public webpage from the moment it exists."