Industry

Shared Claude Chats Were Indexed by Google, and Unguessable URLs Are Not Private

RSS
Cartoon illustration of a round orange character scampering out through a half-open purple door with an armful of papers, leaving a trail of documents and speech bubbles across the floor behind it.
Shared Claude conversations were indexed despite the pages serving a noindex header, because the robots.txt block stopped Google from reading it. Illustration: AI-generated.

Over the weekend of 25 July 2026, a Reddit user noticed that a site:claude.ai/share query in Google returned a long list of shared Claude conversations, and in some cases the Artifacts generated inside them. 404 Media reported it first on the Monday morning, followed by TechCrunch, Axios and Fortune. Futurism reported finding a detailed medical report on a real patient, clinical trial results including patient names, documents listing the names and phone numbers of primary school-aged children, company documents marked internal-use-only, and employee reviews containing personal information about workers.

Anthropic said the behaviour was not the result of a bug or a data breach. Spokeswoman Amie Rotherham said the company does not share chat directories or sitemaps with search engines such as Google, that the shareable links “are not guessable or discoverable unless people choose to share them themselves”, and that when someone shares a conversation they are making that content publicly accessible, so like other public web content it may be archived by third parties. Anthropic separately told TechCrunch that share links only appear in search results when they have been posted somewhere search engines can see, such as a forum or a social media post. By the Monday afternoon, the conversations no longer appeared in Google through the query people had been using.

Anthropic’s defence, that the links are not guessable, is accurate and beside the point at the same time. Google does not need to guess a URL to index it. It needs to reach one.

A share feature exists so that people can post the link somewhere: in a Reddit thread, a Slack channel, a forum, a public document. The moment a shareable URL appears on any page Googlebot can crawl, it becomes a candidate for indexing. From there, whether it actually gets indexed comes down to what the page tells crawlers, and, crucially, whether Google is allowed to read that instruction at all.

That is the gap between “not guessable” and “not indexed”. Obscurity keeps a URL out of sight of a human who does not already have it. It does nothing to keep the page out of an index once the URL has been seen.

Google made the same point from its own side. Spokesperson Ned Adriance told TechCrunch that neither Google nor any other search engine controls which pages are made public on the web, that these pages were indexed across many search engines, and that Google gives site owners clear controls over whether pages can be crawled or indexed and always respects those directives.

Why doesn’t a robots.txt disallow stop indexing?

This is where the incident becomes a textbook case rather than just a privacy story, and it is the part most of the early coverage got the wrong way round. Several outlets, including The Decoder, reported that the share pages carried no noindex at all. They did carry one. It was simply unreachable.

Checking the live configuration on 30 July 2026, the picture is this:

  • claude.ai/robots.txt contains Disallow: /share/*, and it sits in the User-agent: * group with no separate Googlebot group, so that is the group Google follows.
  • A share URL responds with the HTTP header X-Robots-Tag: none. Google treats none as equivalent to noindex, nofollow.
  • The same header is served when the request identifies itself as Googlebot, and the response carries Vary: User-Agent.

Those two controls cancel each other out. A noindex only works if a crawler is permitted to fetch the page and read it. Blocking the path in robots.txt guarantees Googlebot never makes that request, so the noindex is never seen, while the URL itself can still be indexed on the strength of links pointing at it from elsewhere. Google’s own documentation and John Mueller have said this for years, and Martin Splitt has specifically warned against putting both rules on the same page. The result is the worst of both: a directive that would have kept the pages out of Search, sealed behind a directive that stopped anyone reading it.

Independent IT consultant Daniel J. Glover reported the same conflict on 26 July, and Search Engine Journal confirmed it on 27 July. One caveat matters: nobody has established what was served when the URLs were first discovered and indexed. The header may have been added during remediation. So treat the conflict as confirmed configuration rather than as the proven cause.

The Artifacts path behaves differently again. /public/artifacts/ is not listed in robots.txt at all, and a request to an artifact URL returns no X-Robots-Tag header, so the two paths were never governed by the same controls.

Has this happened before?

Twice, and once already to Claude. Forbes reported a similar Claude exposure in 2025, when Google estimated it had indexed just under 600 conversations before the pages dropped out of search results. How closely the July 2026 exposure tracks that scale has not been independently confirmed.

The better-known case is OpenAI’s, in August 2025. ChatGPT briefly offered a “make this chat discoverable” toggle on its share dialog; users ticked it, often without registering what the smaller grey subtext meant, and Fast Company found thousands of shared ChatGPT conversations in Google. Those chats did not explicitly carry identifying information, though some contained details specific enough to point back to the person. OpenAI removed the option and worked to pull the indexed pages. Separately, 404 Media reported that a researcher had scraped around 100,000 publicly shared ChatGPT conversations.

The cases are not identical. ChatGPT had an explicit opt-in that made the pages eligible for indexing; Anthropic maintains there was no directory or sitemap sharing on its side. But the outcome converged: a “private-feeling” URL reached a public index anyway. In ChatGPT’s case because a toggle made it eligible, in Claude’s because the signal that should have kept it out was placed where no crawler could read it.

What this means for SEO

The specifics belong to two AI companies, but the underlying mechanism is standard technical SEO, and it applies to any site that exposes user-generated or “shareable” URLs: share links, public profiles, preview pages, print views, staging paths, or anything with a “secret” URL.

  • Treat an unguessable URL as public. If a page returns a crawlable response and is linked anywhere Googlebot can reach, assume it can be indexed. A hard-to-guess slug is not access control and not a crawl directive.
  • Never pair a disallow with a noindex on the same path. This is the concrete lesson here. If you want a page out of the index, allow crawling and serve noindex (meta robots tag or X-Robots-Tag header). If you block the path in robots.txt, the crawler cannot read your noindex, and an externally linked URL can still be listed. Pick one control, and pick the one that matches your goal.
  • Audit for this conflict specifically. Check any path you believe is hidden: fetch it and look at the response headers, then check that path against your robots.txt. A noindex behind a Disallow looks locked down in two places while achieving neither. The URL Inspection tool in Search Console will report the URL as blocked, which is the tell.
  • Do not confuse robots.txt with privacy. Genuinely private content needs authentication, not a directive that politely asks well-behaved crawlers to skip it.
  • Audit your own share and UGC surfaces. Anywhere your product mints a URL that users pass around, check what that page tells crawlers. The default should be noindex unless you have a deliberate reason to want those pages found in Search.

None of this is a new Google policy. Google indexed these pages by behaving exactly as it always does. The story is a reminder that indexation control is the site owner’s job, and that “nobody will find the link” is not a plan.

Sources

More news

Add as a preferred source on Google