Anthropic's AI assistant Claude recently had a privacy vulnerability exposed in its sharing function. Some conversations accessed via shared links were temporarily searchable by Google, allowing external users to view the content without logging in. Anthropic subsequently updated its settings, and Google began removing the relevant results.
Missing noindex tag
The incident was discovered by a Reddit user on July 25. By design, such sharing pages should be closer to unpublished pages that can be accessed simply by knowing the link, rather than public web pages open to search engines.
The problem is that the page is missing the `noindex` tag. This HTML directive tells search engines not to index the page. Once a shared link appears in forums, social media platforms, or collaboration tools, search engines may discover and index it.
Public artifacts are also included.
It wasn't just chat logs that were affected. Claude's artifacts feature allowed users to create apps, dashboards, and tool pages, which were also once searchable.
The report mentioned that external users had found salary tables containing employee names, exported customer relationship management chat content, and unreleased product roadmaps through the site's search syntax, indicating that the problem had spread to more sensitive data.
Google has begun removing the results.
By July 26, Google began removing related Claude search results. Reports indicate that Anthropic has updated its page configuration and added the noindex tag to prevent subsequent pages from being indexed by search engines.
This incident once again highlights the risks associated with generative AI products in terms of sharing and default privacy settings. Users often use chatbots as semi-private tools, but once the link enters the public network, the visible scope of the page can expand rapidly.
Additional information:OpenAI had previously encountered similar issues due to ChatGPT's discoverable chat feature, with related conversations being recorded by Google, Bing, and DuckDuckGo.
