Shared AI Chats Are Sitting Exposed on Search Engines

Shared AI Chats Exposed on Search Engines. Grok alone leaked around 370,000 of them. Anthropic pulled the leaked Claude share links out of Google over the weekend, and it had the feel of the end of it, but it wasn’t, because the internet keeps a copy of everything you make public, even for a second. I ran it through my own tool, Dorks Eye. The problem is many times bigger than I thought. Here is what’s going on 🧐

When you press share on a conversation with Claude, ChatGPT, Grok, Gemini or Copilot, the app takes a snapshot of that chat and turns it into a page with its own web address. Public means public. Whoever reaches that address can read the conversation. They need no account and no permission, and you never find out they were there. You thought you handed one link to one person. What you made was a page sitting on the open internet, and its address can be found.

A web page can carry a quiet instruction that tells search engines to leave it alone. It is called a noindex. On the Claude share pages that instruction was there. But the site also blocked the search engine’s crawler in a separate file called robots.txt. A crawler that is not allowed to open the page never gets to read the instruction inside it. So once people started posting share links around the web, in a public Slack, a Discord, a GitHub issue, an X post, the search engine listed the address anyway. It was never told not to.

Anthropic got this right in one place and wrong in another. The shared conversations sat under one address that was blocked in robots.txt, so the noindex on them was never read. The published artifacts sat under a different address that was not blocked. There the crawler could open the page, read the noindex, so those pages fall out on their own. Even now they still come back in the search results, and they open the moment you click, no sign-in needed. The pages that looked more locked down were the ones that leaked.

This trap is older than this weekend. Back in February 2024, Google’s own Gemini fell into the exact same one. Its share pages were disallowed in robots.txt and carried a noindex the crawler could never reach, so they turned up in search too. Google fixed it by removing the block, so the noindex could finally be read.

One company having a bad week would be a coincidence. This same mistake has hit the news four times in twelve months, at three different AI companies, and the headlines are only the part that got noticed. In July 2025, shared ChatGPT conversations turned up in search, and OpenAI pulled the feature. ChatGPT had let you tick a box to make a shared chat discoverable, and enough people ticked it without grasping what it meant that private conversations ended up in Google. OpenAI called it a short-lived experiment and removed it. In August 2025 it was Grok. There, pressing share published your conversation straight onto Grok’s own website, with no box to tick and no warning, and nothing on those pages held the crawlers back, so Google, Bing and DuckDuckGo listed them. In September 2025 it was Claude, when Forbes found hundreds of Claude conversations in Google. And then again this weekend. Each time the word share quietly meant published, and the people using it did not know that was the deal.

I am not writing this to point at one company. That is not what I do. This is the pattern, and the pattern is the story.

Most of what sits inside these pages is harmless. People share a recipe, a snippet of code, a travel plan, and they meant for it to be seen. That is fine. The problem is that the share button does not tell the difference. A grocery list and a password get the same public page, the same kind of address.

So in among the ordinary chatter, people found API keys, the passwords that let one piece of software log into another. They found crypto wallet keys sitting in plain view, the kind that let someone empty a wallet. They found resumes with full names, home addresses and phone numbers. A lawyer asking whether a professional conduct breach had to be reported. And the private questions people ask about their health, their debts and their relationships, typed in because they thought only the machine was reading along. On the Claude pages there was one more detail that turned a faceless leak into a personal one. Each shared page carried the first name of whoever had shared it.

You do not even need the original link to reach these pages. You can ask the search engine for them. There is a plain search operator that tells the engine to show only the pages living under one address, and you type it into the same search box you use to look things up:

1
2
3
4
5
6
7

site:claude.ai/share
site:claude.ai/public/artifacts
site:chatgpt.com/share
site:grok.com/share
site:gemini.google.com/share
site:copilot.microsoft.com/shares
site:poe.com/s

None of that is hacking. It is ordinary search, pointed with a little precision, and these queries are known as dorks. I ran them through my own tool, Dorks Eye, which takes one of these dorks and fires it at DuckDuckGo, Bing, Brave, Yandex and Google at once, then collects the pages each engine hands back. In a single pass I can see what is still exposed and where, without going through each search engine by hand. That matters, because the page one engine has dropped is very often still sitting in another. When I aimed Dorks Eye at Claude, ChatGPT, Grok, Gemini, Copilot and Poe, the share pages were still there, still open. And that was one run, from one address, showing a limited batch. Point a plain Google search at grok.com/share and the results run page after page, into the hundreds and beyond. And it is not only these. Aim the same trick at Perplexity, Mistral or Qwen, and their shared pages come back just the same.

This looks fixed. Anthropic pulled the Claude links out of Google over the weekend, and that has the feel of the end of it. It is not. The same pages kept coming back on Bing and Brave. In some countries they are still sitting in Google itself. A removal at one search engine does nothing at the others, and it does not carry from one country to the next.

And there is worse. Before the cleanup had even started, someone had already scraped the leak and dropped it into public repositories on GitHub, with Claude conversations and Grok conversations saved side by side for good. The copies go further than one repository. Security researchers counted more than 143,000 shared conversations sitting in the Internet Archive, across Grok, ChatGPT, Copilot, Claude, Mistral and Qwen. Pulling a page out of Google does nothing to the copy someone else grabbed an hour earlier. Once a thing has been public, even for a single second, you no longer get to decide who kept it.

The uncomfortable part underneath all of this is that nothing here was hacked. There was no break-in, no password was stolen, and no server was cracked. The share button did exactly what it was built to do, and the search engines did the ordinary job of listing public pages. The only thing that went wrong is that the word share sounded private, and people trusted it.

So treat the share button as what it is, a publish button. Before you ever press it, read the conversation back and take out anything you would not paste onto a public web page: the keys, the wallet details, the names and the numbers, anything that points back at you. And if you have shared chats sitting out there from before, go and pull them down.

• → In Claude, open Settings, then Privacy, then Shared chats, and unshare each one.
• → In ChatGPT, Grok and the others, open your account settings, find the list of shared links, and revoke them.
• → If a page is already sitting in a search engine, unshare it at the source first, then ask the engine to remove it, and know that the caches and the archives will lag behind for a while.

Assume that anything you shared in the past, even once, may already be resting somewhere you can no longer reach.

Turning a search engine into a way to find what people and companies have left exposed, and doing it without leaving a trace, is a full chapter in my ethical hacking course. I teach OSINT and reconnaissance from the ground up, with a lesson on this exact kind of dorking: the operators that surface the files, the logins and the pages that were never meant to be public, and how to stay quiet yourself while you go looking.

→ Join my complete ethical hacking course

Hacking is not a hobby but a way of life.

Sources: Google Search Central: Block indexing | Reddit r/ClaudeAI disclosure thread | Shared-Claude-Chats archive on GitHub