The share button is a publish button

What happened

Malwarebytes reported on 28 July that some Claude conversations which users had chosen to share were discoverable through Google search. This was not evidence that private Claude accounts had been breached. Anthropic's own guidance says chats are private by default. For Free, Pro and Max users, Share can create a public snapshot that anyone with the link can view, including every message sent before sharing and any artifacts in the conversation.

WIRED reviewed a sample of shared pages and found they did not contain the noindex instruction used to keep a public page out of search results. By the time WIRED reported, the relevant results were no longer appearing in Google, although some remained visible through Bing. Anthropic told WIRED that it did not provide search engines with a directory or sitemap, and that the links were not guessable or discoverable unless users chose to share them. The useful distinction is therefore between private chats and deliberately created public snapshots whose audience expanded beyond what their creators expected.

A link is not access control

An obscure URL can feel private because only the intended recipient initially has it. Technically, however, a page available to anyone who presents the link is public. The recipient can forward it, and a public page that links to it can make the URL discoverable beyond the original audience.

Google's guidance makes the boundary clear. A noindex rule can keep a page out of Google while leaving it directly accessible; confidential information should instead be removed or protected by authentication. The NCSC applies the same principle to AI systems more broadly: prompts, data, outputs and logs are organisational assets, and generated content should be handled according to the sensitivity of the material that produced it.

What businesses should do now

Anyone who has used public AI sharing should review existing links rather than trying to remember what they published. Anthropic provides a Shared chats list under Settings and Privacy for free, Pro and Max accounts; changing a chat back to Private disables the current direct link. Team and Enterprise sharing is restricted to members of the same organisation, but the visible conversation still deserves the same sensitivity review.

If a shared snapshot contained a password, API token, private key or recovery code, unsharing is only the first containment step. Beekeeper recommends revoking and replacing the secret, invalidating affected sessions, preserving a short incident timeline and checking whether the material was copied elsewhere. If personal data was exposed, use the organisation's breach process. The ICO requires every personal-data breach to be recorded and risk-assessed; notifiable breaches must be reported within 72 hours of becoming aware, where feasible, while high-risk cases require affected people to be informed without undue delay.

• Audit every existing public AI-chat and artifact link.
• Unshare material that was not deliberately approved for public release.
• Rotate exposed credentials rather than assuming link revocation solved the problem.
• Escalate personal or customer-data exposure through the normal breach process.
• Give staff one plain rule: public Share means publish.

The Beekeeper view

The AI element is new; the control failure is familiar. Public links are convenient distribution mechanisms, but they are poor confidentiality controls. A business should define which AI services are approved, what information may enter them, who may create public links and how those links are reviewed and revoked.

The strongest preventive control is not a longer warning beside the Share button. It is a short, usable policy backed by technical restrictions where available: minimise personal data, never paste secrets, redact before sharing and require a second pair of eyes before business material becomes public.