Your Claude Share Link Is More Public Than You Think

There is a thread on the ClaudeAI subreddit making the rounds today pointing out that a large number of Claude conversations that users have chosen to "share" are, in fact, indexed by search engines and can be browsed by anyone who knows what to search for. This is not a Claude bug. This is a Claude feature working exactly as designed, meeting a decade and a half of people misunderstanding what "share link" actually means. I think it's worth writing up as a PSA, because the specific examples I found in ten minutes of looking are the kind of thing that ranges from mildly embarrassing to career-ending, depending on the person.

Let me start with the punchline. The first thing Redditors stumbled onto was a conversation in which a user was walking through the setup of a cryptocurrency wallet, complete with the seed phrase and the resulting private keys, all sitting in the shared transcript, indexed and publicly readable. As of the writing of this post, there is $2.73 in the wallet. Whoever they were, someone will eventually notice, drain it, and there is nothing they can do about it because the keys are effectively on the front page of a filing cabinet the whole internet can walk into.

I am not going to link that one, because the person involved has made a small enough mistake that they deserve at least the dignity of my not being the reason it accelerates.

The next one is this shared conversation, in which a Kentucky lawyer asks Claude whether he needs to self-report an apparent breach of professional conduct to the state bar. To the person's fortune, the transcript itself is scrubbed enough that you cannot identify them from what is on the page. The remarkable part is not the underlying question, which is a serious matter that deserves serious thought. The remarkable part is that someone in a fiduciary role sat down, worked through the internal deliberation with a chat interface, and then hit the share button on the whole thing. Whatever this lawyer decided to do about the actual ethics issue, the reflex to publish that deliberation to the public internet is its own tell, and if this had been almost anyone else in that person's professional network who stumbled on the link first, it would be a very different Tuesday for them.

I found a third one in which someone had used Claude to draft an "AI thought leadership" post for LinkedIn, then shared the transcript, apparently forgetting that the transcript reveals both the entirely-AI provenance of their piece and their subsequent instructions to make it sound like they wrote it. If you Google the title of the article you can find it on LinkedIn under the "author's" name. Their LinkedIn presence is unlikely to survive this particular disclosure with its credibility intact.

I could keep going. There are, according to a Forbes writeup from September 2025, hundreds of these. Anthropic worked with Google to de-index them from Google search back then. They are still visible via Bing, via Brave, via any other search engine that will honour a site:claude.ai/share query.

What is actually happening

For those not familiar with how sharing works in modern web apps, here is the shape of it.

When you click "Share" on a Claude conversation, Anthropic generates a URL with a long random UUID in it, something like https://claude.ai/share/2e01ad60-ca38-4e14-ab60-.... That URL is unguessable by brute force. If nobody ever links to it from a public page and nobody ever tells anyone about it, it remains functionally private, even though it is technically accessible to anyone who possesses the URL.

The catch is the "if nobody ever links to it" part. The moment somebody posts that URL anywhere a search engine crawls (a public GitHub gist, a forum, a Discord server that got indexed, a LinkedIn post, a personal blog, an email that got scraped by a mailing-list archive, or, in the case of the LinkedIn spam author, the very article they were shilling using it), the URL becomes discoverable, and from that point it is essentially public. Google, Bing, and every other crawler will index it. Search operators like site:claude.ai/share will surface it. And nothing about the original share process warned the user that this was the operating model.

Anthropic's own documentation says as much, in language that a normal person will not read: shared links are "accessible to anyone with the link." The word anyone is doing a lot of work in that sentence. In the mind of the user clicking "share," anyone means "the friend I sent the link to." In the mind of the search engine, anyone means anyone, human or otherwise.

We have been here before

If this feels familiar, it is because it is. This exact category of "wait, I thought that was private" failure is roughly as old as sharing links themselves.

Google Docs "anyone with the link can view" ended up producing an entire genre of accidentally-public corporate documents indexed and searchable for years. Trello boards left with public visibility surfaced customer lists, product roadmaps, and, memorably, a police department's internal notes. Publicly readable S3 buckets have been generating incident-response engagements for the better part of a decade. Public GitHub gists have leaked API keys, credentials, and internal source since GitHub existed. Pastebin was so reliably a source of leaked data that entire threat intelligence products exist specifically to scrape it. Every one of these is the same pattern. A system offers a "share" mechanism. Users assume the mechanism is scoped to the people they consciously shared with. The mechanism is actually scoped to the entire internet. Time passes. Somebody's problem gets very large very quickly.

The reason it keeps happening is not that users are stupid. It is that the mental model of share as most people use the word in daily life ("I am giving this specifically to you") is at odds with the mental model of share as web applications typically implement it ("I am creating a URL that, if it becomes known, is public"). Every generation of platform re-learns this and every generation of users hits it fresh.

AI just makes the blast radius bigger

Here is what is genuinely new about the Claude case, and it is not really a Claude problem (OpenAI and others have had similar issues).

We are pouring a great deal more high-value, high-sensitivity content into AI chats than we ever put into a shared Google Doc. Chat with Claude runs through legal strategy, financial planning, medical questions, work secrets, code with API keys in it, family conflict, therapy-adjacent reflection, and everything else people would previously have written on the back of an envelope and then burned. The chat interface encourages a rambling, high-context conversation, which means the transcripts have far more concentrated personal data per line than most previous formats. And then the sharing mechanism, which was designed for showing your friend a funny answer, is being used to share the whole thing.

The industry-wide lesson here is that AI has not invented a new privacy failure mode. It has just made the existing one dramatically more consequential per incident. Where a Google Doc might have leaked a status update, a Claude share leaks the full internal monologue of a person working through a decision, complete with all the second-guessing and self-justification that would normally never leave their own head. AI let us shoot ourselves in the foot faster than ever. With more data.

What to actually do

So what can we do about this? The list is short and boring.

First, assume that any share link you generate for any web application is functionally public the moment you send it to anyone. That is the correct threat model. If the underlying content is anything you would not put on a billboard, do not generate the link. Screenshot the relevant part instead. Send the screenshot over a channel you actually control (Signal, encrypted email, a private Slack channel). The share button is a convenience for low-stakes content, not a privacy control for high-stakes content.

Second, go through your own Claude account and revoke any share links you generated for things you would not want a stranger reading. Anthropic exposes a list of your shared conversations in the settings. Delete the ones that matter. Deleting the share revokes public access.

Third, and this is the pattern I keep coming back to across several recent posts on this blog, treat AI vendors as the same kind of critical infrastructure as any other cloud service you depend on. That means understanding their data handling defaults, checking their sharing mechanics, and not putting content into them that you would not put into a badly-configured public S3 bucket. Because that is, effectively, what a share link is.

The bottom line

The bottom line is this. The mechanics that make a Claude share link discoverable are the same mechanics that made Google Docs, Trello boards, Pastebin, GitHub gists, and every other "anyone with the link" system before them discoverable. Nothing here is new. What is new is that the average conversation with a modern AI assistant contains more sensitive personal, professional, or financial context per screen than any of the older channels ever did, and the users treating the share button as a private forwarding mechanism are exposing correspondingly larger amounts of themselves when they get it wrong.

We used to be able to embarrass ourselves one document at a time. Now we can do it one entire train of thought at a time. That is not a technology story. That is a human story with a technology accelerant. Please be careful with your share links.

And to the Kentucky lawyer, whoever you are, you should probably call the bar.