Google Indexed Private Claude Chats, Exposing API Keys

Google indexed hundreds of shared Claude conversations, exposing API keys, resumes, financial records, crypto wallet details and clinical trial data, per TechCrunch.

The pages surfaced through plain site:claude.ai/share search queries. Anyone running that search could open what was supposed to be a private link, shared with one person.

Anthropic's robots.txt told crawlers to stay off the share pages, but that only stops a crawler that starts at claude.ai. It does nothing once a URL is already circulating somewhere else. Once share links started circulating in forums, Google found them there and indexed whatever the pages contained.

No noindex tag was set on the pages themselves. That's the only signal that actually tells a search engine to leave an already-found result out of its index.

Anthropic added the fix by July 26, per the report. I've shipped this exact bug myself: a "private" share link protected by a robots.txt disallow, no noindex tag set. I treated the two as interchangeable, and they aren't. Robots.txt only works if the crawler starts from your own site. Noindex works no matter how Google found the page.