Over the weekend, people started finding private AI conversations in Google.
Not leaked. Not hacked. Indexed. A single site: query against the Claude share domain returned pages containing a detailed medical report on a real patient, clinical trial results with patient names attached, internal company documents, and contact details for minors.
A piece on Search Engine Journal traced the cause, and it turns out to be the most boring technical detail in SEO. That detail just cost a multibillion dollar AI company its week.
Crawling and Indexing Are Two Different Verbs
The shared chat pages carried an X-Robots-Tag header set to none. That header is the instruction that actually keeps a page out of search results.
The same pages were also blocked in robots.txt. That is where it broke.
Robots.txt is a request not to crawl. It is not a request not to index. When Googlebot is told to stay out of a URL, it stays out, which means it never opens the page and never reads the header telling it to drop that page. Google's own documentation says this plainly: a blocked page can still be indexed if something links to it, because Googlebot notes the URL without opening it.
So the block meant to protect those pages is the exact reason they survived in the index. The noindex sat behind a locked door, and Google catalogued the door.
This is not an Anthropic problem. OpenAI pulled shared ChatGPT conversations out of Google in August 2025. Google blocked Bard transcripts back in 2023. Forbes reported roughly 600 Claude conversations indexed last year, and close to 100,000 ChatGPT conversations were scraped in 2025.
Four incidents, three companies, one misunderstanding that has been documented since the 1990s.
Every Company Has a Share Surface Now
Here is why this matters if you do not run an AI lab.
Almost every tool your team touches ships a share link. Notion pages, Figma files, Loom recordings, BI dashboards, proposal builders, internal wikis, AI assistants. Each one mints a public URL that is technically unlisted and practically permanent.
Unlisted is a design choice, not a security control. The moment that URL appears in a public Slack channel, a support ticket, a partner's site, a forum answer, or a sitemap somebody forgot to prune, it becomes discoverable.
And the reflex defense your team reaches for, blocking the path in robots.txt, is precisely the move that keeps the page in Google while refusing to let Google read your instruction to remove it.
The correct architecture is inverted from what most teams assume. If you want a page out of search, you have to let the crawler in so it can read the noindex. If you want a page genuinely private, robots directives are irrelevant and you need authentication. There is no third option, and there never was.
This is the same class of mistake I wrote about in why Google stops crawling your AI content. Teams treat crawler instructions as a control panel for a system that was designed as a courtesy protocol.
The Gap Between the User's Model and the System's Behavior
Anthropic's position is that shared links only appear in search when they have been posted somewhere search engines can see, and that users control whether a conversation becomes public.
Both statements are accurate. Both miss the operational reality.
The person clicking share is making a decision about one reader. The system records it as a decision about the entire internet, permanently. That gap between the user's mental model and the machine's behavior is where every one of these incidents lives.
There is also no recourse. A user cannot file a removal request for a domain they do not own, and cannot influence what Anthropic serves to Googlebot. The only lever available is unsharing the chat under Settings, Privacy, Shared Chats, then waiting for a cache to clear on somebody else's schedule.
By Monday afternoon the search results were gone. The exposure window was a weekend. Nobody can tell you who copied what during it, which is the part that should bother a CEO more than the headline.
What to Do This Week
Run a site: query against every domain and subdomain you own. Include the ones you inherited from a former agency, a departed developer, or an acquisition, because those are where the surprises live.
Then run the same query against the share subdomains of every SaaS product holding your data. You are not looking for your marketing pages. You are looking for the things you assumed nobody could find.
Then check the actual headers on anything sensitive. If a page is disallowed in robots.txt and also carries a noindex, you have the broken configuration, not the safe one. Making your infrastructure readable to machines is a discipline I covered in make your site legible to machines, and this is the same discipline pointed at your risk surface instead of your visibility.
Obscurity was never a setting. It was a hope, and it just expired publicly.