Claude Shared Chats Leaked to Google: What to Do

By Lazar Milicevic · Published September 14, 2026 · 9 min read

You spent an hour with Claude debugging a client's pricing model. You hit "Share" to send the reasoning to your co-founder. Weeks later, that conversation — customer names, internal margins, the whole thread — shows up in a Google search. This isn't hypothetical. It's happened to Claude users, ChatGPT users, and Bard/Gemini users, and it will happen again the next time a team ships a share feature without thinking through indexation.

If you're a solo founder or run a small ops team leaning on LLMs for real work, this is the wake-up call to audit what you've shared, lock down how your team uses these tools, and stop treating "unlisted link" as a synonym for "private."

What actually happened with Claude share links

Claude's "share chat" feature generates a public URL for any conversation or Artifact you want to hand to a teammate or client. The link is unguessable, but it isn't authenticated — anyone with the URL can view the full conversation, including uploaded files, code, and Artifacts. When those URLs got posted publicly (in Slack exports, GitHub issues, forum threads, help desk tickets, or personal blogs), Googlebot did what Googlebot does: it crawled and indexed them.

The result: site:claude.ai/share queries surfaced real conversations from real users. Some contained API keys. Some contained candidate names from hiring workflows. Some contained internal financial modeling. This isn't a Claude-specific failure — ChatGPT had the same issue in 2024 with its "Share" feature and Anthropic isn't the first vendor to learn that "share by link" defaults to "share with the internet" unless you engineer against it.

The mechanism is boring:

1. A logged-in user shares a chat and gets a public URL.
2. That URL is pasted somewhere a crawler can reach.
3. The share page has no noindex header, no robots.txt exclusion, or the exclusion was added after crawls already happened.
4. Google indexes and serves it in results.

You can reproduce the failure mode in ten minutes with any web app you build. Which is why the interesting question isn't "how did Anthropic screw up" — it's "what does your team's default look like."

How to check if your Claude shares are exposed

Do this today, in this order. It takes about fifteen minutes.

1. Search Google for your own leaks. Run these queries, replacing terms with your company name, product names, and typical file identifiers:

site:claude.ai/share "your company name"
site:claude.ai/share "your-domain.com"
site:claude.ai/share "confidential"
site:claude.ai/share "@your-domain.com"

Also try broader engines — Bing and DuckDuckGo sometimes index what Google has dropped:

site:claude.ai "yourcompany"

2. Audit your Claude account. In Claude, open Settings → check the shared chats list. Anthropic added a bulk view after the incident. Delete anything sensitive. Note: deleting a share link removes public access, but the URL may still be in Google's cache for days.

3. File a removal request for cached results. Use Google's Refresh Outdated Content tool for each indexed URL. This is manual and slow but it's the only way to force cache eviction.

4. Rotate anything that was in those chats. If API keys, database URLs, customer PII, or credentials appeared in a shared conversation — even briefly — assume they're compromised. Rotate them.

5. Search your team's Slack, Notion, and email for claude.ai/share links. Anyone on your team who shared a chat externally is a potential leak vector.

Why "unlisted" is not "private"

The core lesson has nothing to do with Claude. It's a design pattern SMBs need to internalize when using any SaaS with sharing features.

There are three real privacy states for a URL:

"Unlisted" is security through obscurity. It relies on the URL never appearing anywhere a crawler, screenshot OCR pipeline, browser extension, or clipboard-syncing tool can see it. That assumption breaks constantly:

• Someone pastes the link into a support ticket → Zendesk/Intercom sync it to a search index.
• Someone posts it in a public Slack workspace or Discord.
• A browser extension with clipboard permissions phones home.
• The share URL ends up in an analytics tool that leaks referrers.
• Someone screenshots it and OCR indexing picks it up.

If the data would embarrass you or your client when public, it needs authentication, not obscurity.

A hardened workflow for teams using Claude on sensitive work

Here's the workflow I run for clients who use Claude for anything touching customer data, financials, or IP. It's not fancy — it's disciplined.

Rule 1: Classify before you prompt. Every conversation is one of three tiers:

• Green — public marketing copy, generic code snippets, learning. Share freely.
• Yellow — internal but not sensitive. Never use the share feature; screenshot or copy-paste specific outputs instead.
• Red — customer data, PII, credentials, financial models, legal work, IP. Use Claude via the API with your own logging, or use a Claude Enterprise/Team plan with proper data controls. Never share.

Rule 2: Strip before you paste. Before pasting anything into Claude, run a redaction pass. Here's a Python starter I hand clients:

import re

PATTERNS = {
    "email": r"[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}",
    "ssn":   r"\b\d{3}-\d{2}-\d{4}\b",
    "credit_card": r"\b(?:\d[ -]*?){13,16}\b",
    "api_key_generic": r"\b(sk|pk|xoxb|ghp|AKIA)[a-zA-Z0-9_\-]{16,}\b",
    "phone_us": r"\b(?:\+?1[-.\s]?)?\(?\d{3}\)?[-.\s]?\d{3}[-.\s]?\d{4}\b",
}

def redact(text: str) -> str:
    for label, pattern in PATTERNS.items():
        text = re.sub(pattern, f"[REDACTED_{label.upper()}]", text)
    return text

if __name__ == "__main__":
    import sys
    print(redact(sys.stdin.read()))

Wire it to a hotkey (Raycast, Alfred, or a small shell script) so pasting into Claude runs through it. Not a perfect solution — regex misses context-dependent PII like customer names — but it catches the obvious mistakes that end up in indexed shares.

Rule 3: Prefer API + your own storage for Red-tier work. When work is sensitive, call the Anthropic API from a script you control, log to a database you control, and never touch the shared web UI. The API doesn't have a share feature. You can't accidentally leak what you never rendered.

import anthropic

client = anthropic.Anthropic()  # uses ANTHROPIC_API_KEY

response = client.messages.create(
    model="claude-sonnet-4-5",
    max_tokens=1024,
    messages=[
        {"role": "user", "content": "Summarize this contract clause..."}
    ],
)

# Log to your own DB, not to a shared URL
save_to_internal_log(response.content, tenant_id="acme-corp")

Rule 4: Audit shares monthly. Add a fifteen-minute recurring calendar block: check Anthropic's shared chat list, run the site:claude.ai/share searches for your company terms, delete anything stale. Same drill for ChatGPT (site:chat.openai.com/share) and any other LLM your team uses.

Rule 5: Kill the share button in policy. If you have a written AI usage policy — and you should — add one line: "Do not use the 'Share' feature on any LLM tool for work-related conversations. Copy-paste specific outputs into your regular collaboration tool instead." This one rule prevents 90% of the exposure surface.

Broader implications for LLM tool selection

This incident should change how you evaluate LLM vendors for business use. When you're picking a tool for your team, the demo and the model quality are table stakes. The privacy engineering is what actually matters for anything past experimentation.

A pragmatic vendor checklist:

Anthropic, OpenAI, and Google all offer enterprise tiers that address most of these. The gap is between what a solo user or five-person team can access on a Pro plan versus what the enterprise plan gets. Check the current pricing and feature pages before assuming — the tiers shift often.

For the "just me and two co-founders" tier, the honest answer is: use the API for sensitive work, use the web UI for exploration, and never mix them.

What to do right now if you found leaked data

If your Google search turned up real, exposed conversations, here's the incident response sequence. Do these in order, not in parallel — order matters because credential rotation invalidates the exposure timeline.

1. Rotate credentials first. Every API key, database password, SSH key, or token that appeared in an indexed conversation. Assume adversarial parties already scraped it.
2. Delete the shares. In Claude, revoke the share link. This stops new visitors from seeing the live page.
3. Request cache removal. Submit each URL to Google's outdated content removal tool. Also submit to Bing's Content Removal Tool.
4. Notify affected parties. If customer data was exposed, your obligations depend on jurisdiction. In the US, most state breach-notification laws trigger on unauthorized access to PII. In the UK, the ICO expects notification within 72 hours for reportable breaches. Talk to counsel if the data was regulated (health, financial, minors' data).
5. Document the incident. Write down: what was exposed, when the share was created, when it was indexed (Google Search Console will show the discovery date if you own the domain), when you rotated, who was notified. This is standard breach-response hygiene.
6. Post-mortem the workflow. Which person shared it? Why? What did they need that made the share feature the path of least resistance? Fix the workflow, not the person.

The last step is the one people skip and it's the one that prevents the next incident. Nobody hits "Share" out of malice — they hit it because it was faster than the alternative. If your team's approved workflow for handing off an LLM conversation to a colleague is worse than clicking Share, they'll click Share again.

How BizFlowAI approaches this

We design Claude and LLM workflows for solopreneurs and small ops teams the way I'd want them designed for my own business: sensitive work runs through the API with our own logging, redaction happens before data ever hits a model, and the "share this with a colleague" step goes through tools your team already uses — Slack, Notion, Linear — never through a public share URL. Access controls are set at the workflow level, not left to whoever clicks the button.

If you're using Claude, ChatGPT, or Gemini on customer data, contracts, financial models, or hiring pipelines and you're not sure whether your setup would survive the same scrutiny as the shared-chat incident, that's exactly the audit we do on a discovery call. We'll walk through what you've built, where the leak surfaces are, and what a hardened version looks like — usually a weekend of work, not a quarter.

Work with BizFlowAI

If you'd rather have this built for you, that's what we do: production AI automation for solo founders and small teams — agents, integrations, and document pipelines that actually ship.

Book a free discovery call — 30 minutes, we map the highest-ROI automation in your workflow. No pitch deck, just engineering.

More guides like this on the BizFlowAI blog.