Claude chats with sensitive data found on Google Search
What it really says
On July 25, 2026, Reddit users discovered that Google searches using the operator 'site:claude.ai/share' returned hundreds of publicly shared Claude conversations and Artifacts. The indexed content included highly sensitive data: cryptocurrency wallet keys, API credentials, resumes with real names and contact information, payroll spreadsheets with employee names, internal CRM exports, clinical trial documents with complete patient data (names, ages, genders, ethnicities, skin types, treatment dates), and unreleased product roadmaps. The technical cause: Anthropic had blocked search engine crawlers from the /share directory via robots.txt but had not set 'noindex' meta tags on individual pages. Since users had posted sharing links on public platforms such as forums, GitHub, and social media, Google was able to find and index these pages via external links despite the robots.txt directive. Anthropic stated that shared links are 'public by design' and were not supposed to be discoverable without a direct link. By July 28, Google had removed most results. However, Bing and other search engines continued to display the links initially, and a GitHub repository had already archived thousands of the exposed messages.
Our assessment
Clinical patient data, API keys, and crypto wallets from Claude chats were discoverable via Google for days. Google has since removed the results, but a GitHub repository has archived thousands of chats. Important context: users themselves made the content public through the share feature. Anthropic did not expose private chats. But the missing 'noindex' tags were a technical oversight that massively amplified the risk. When you share a link, you expect the recipient to see it, not for Google to show it to everyone. Particularly problematic: many users apparently did not understand that shared links are permanently public. The exposed medical data, including complete patient profiles from clinical trials, would constitute a clear GDPR violation in the EU. The incident reveals a fundamental problem: AI chatbots are increasingly used for sensitive work without users fully understanding the implications of sharing features.
Relevance for Germany
This incident is particularly relevant for German users. First, the indexed data included medical information that is specially protected under the GDPR (Article 9, special categories of personal data). If German users shared such data via Claude, there could be consequences for the responsible parties. Second, German companies using Claude for internal work should review their sharing settings. Payroll data, CRM exports, and product roadmaps published through the share feature represent a compliance risk. Third, the incident reinforces the recommendation from Germany's BSI and data protection authorities not to enter personal or confidential data into cloud-based AI systems. Starting August 2, the EU AI Act transparency obligations will also take effect, aimed at providing greater clarity on data processing. German users should check their Claude settings for unintentionally shared conversations and revoke them if necessary.
Fact check
The incident is confirmed by multiple independent sources. TechCrunch, VentureBeat, Fortune, and CyberSecurityNews consistently report the discovery on July 25, 2026 by Reddit users. The technical cause (missing noindex tags despite robots.txt entries) is documented with technical analysis by Cybernews and CyberSecurityNews. Anthropic's statement that shared links are 'public by design' is cited by multiple sources. The removal of Google results by July 28 is confirmed by follow-up reports. The existence of the GitHub archive with thousands of exported chats is documented by multiple security researchers. The types of exposed data (wallet keys, API keys, medical data, payroll spreadsheets) are consistently reported across sources.
Source
- • https://techcrunch.com/2026/07/27/psa-your-claude-shared-chats-and-artifacts-may-have-ended-up-on-google/
- • https://venturebeat.com/technology/uh-oh-some-claude-shared-conversations-and-artifacts-appear-to-be-indexed-and-publicly-accessible-on-google-search
- • https://cybersecuritynews.com/claude-ai-shared-chats/
- • https://fortune.com/2026/07/27/a-trove-of-users-seemingly-private-conversations-with-anthropics-claude-ai-chatbot-showed-up-in-google-search-results/
Feeling uneasy about AI in general, beyond this one story?
Fear of AI: why it is normal and what actually helps