TL;DR
- Roughly 600 Claude conversations appeared in Google and Bing because shared pages carried no noindex tag, exposing API keys, crypto wallet details, CVs with real names and phone numbers, and a lawyer’s notes on an ethics case.
- Nobody was breached; the systems behaved as designed, and the design assumed a level of attention people under deadline pressure do not give a sharing dialog.
- The same pattern appears in SharePoint, where a folder left on the default “anyone with the link” is reachable by whoever finds that link anywhere.
- Treat a Share button as a publish gate; Anthropic patched the tag on the 27th, and that stops new indexing without unpublishing cached copies.
In plain English
A noindex tag is a short instruction in a web page telling search engines to leave it out of their index. Search engines run crawlers, programs that follow links across the web and file what they find. A shared Claude page without that tag became eligible for filing, so as soon as one of those links appeared anywhere crawlable, a forum post, a tweet or a Slack export, the conversation behind it entered public search results.
Search engines also keep cached copies of pages they have already filed. Adding the tag afterwards stops fresh indexing and leaves those copies in place, which is why the click that shares something is the only real control point. The SharePoint comparison works the same way: the permission setting is a publish decision presented as a convenience, made by people trying to get an invoice out by five o’clock.
Roughly 600 Claude conversations turned up in Google and Bing this week, and not because anyone broke into Anthropic’s servers. Users clicked Share, which is supposed to hand a link to one person, and the resulting page had no noindex tag on it. So the moment that link touched anything crawlable — a forum post, a tweet, a Slack export — search engines picked it up and filed it away. What got filed included API keys, crypto wallet details, CVs with real names and phone numbers on them, and at least one lawyer’s notes on an ethics case (IBTimes UK, Cybernews). Anthropic patched the tag on the 27th. The cached copies didn’t get the memo.
I don’t do incident response on Claude specifically, but I’ve watched this exact failure play out enough times in client work that I stopped being surprised by the mechanism years ago. Take SharePoint. I’ve lost count of how many small businesses I’ve consulted for where someone hit “Share” on a folder, left the default set to “anyone with the link,” and had no idea that meant anyone — not “anyone who already has the link because I sent it to them,” but anyone who finds the link at all. The sharing controls exist. They’re just built by engineers who understand the permission model, for users who just need to get an invoice to a client by five o’clock and don’t read the dropdown before clicking blue.
That’s the actual failure, and it’s not really about AI. Anthropic didn’t get hacked, and neither did any of my clients. The systems worked exactly as designed. The design just assumed a level of attention nobody under deadline pressure is going to give a sharing dialog. Claude’s problem was a missing meta tag. SharePoint’s problem is a default. Different bug, same root cause: a publish action dressed up as a convenience feature, with no friction between “share with Dave” and “share with Google.”
If a tool of yours has a Share button, treat it as a publish gate until proven otherwise. Check what “anyone with the link” actually means before you use it for anything with a client’s name, a key, or a number attached. Anthropic’s fix stops new indexing — it doesn’t unpublish what already got copied. Neither does deleting a SharePoint link after the fact. Once it’s out, the only real control you had was the click before you shared it.