Hundreds of Claude AI Chats Exposed Online Due to Indexing Error

Hundreds of private conversations with the Claude AI chatbot were inadvertently made public online, accessible through simple search engine queries. The issue stemmed from a flaw in the AI's "share" function, which generated public URLs for chats that were incorrectly indexed by search engines like Google, Bing, and Brave.

An issue previously addressed in September of last year resurfaced, allowing previously shared chats to become publicly discoverable. A Reddit user flagged the vulnerability, discovering that a targeted search could uncover conversations covering a wide range of topics, from political affiliations and conspiracy theories to personal advice and even graphic role-playing, which violates Claude's usage policies.

Some exposed chats contained personally identifiable information, making it possible to identify the users involved. In at least one instance, a user shared cryptocurrency wallet details, potentially exposing financial assets. The shared links were not protected by the necessary "noindex" tags or robots.txt files that typically prevent search engine crawlers from cataloging such content.

While the indexing error appears to have been rectified by Anthropic, the company behind Claude, any chats shared and indexed prior to the fix may still be accessible if their URLs were previously found or archived. These specific chats no longer appear in search engine results, but direct access via the original URL remains possible. The company stated that shared conversations are intentionally made public by users and, like other public web content, may be archived by third-party services.

Users concerned about their chat privacy can manage their shared conversations through Claude's settings. By navigating to 'Settings,' then 'Privacy,' and selecting 'Shared Chats,' users can unshare conversations or verify their current privacy status. Although the immediate risk of new chats being exposed through this specific indexing error has been mitigated, conversations that were previously shared and indexed may still pose a privacy concern.

Anthropic emphasized that users have control over sharing their Claude conversations and that the company does not share chat directories with search engines. The shareable links are not designed to be guessable or discoverable unless intentionally shared by the user.