Were private Claude chats leaked into Google? The exposure was real. “Private” is the wrong word.

The dispute collapses three distinct states into one word, and the distinction is the whole case:

• Private — visible only to the account holder. Claude chats are in this state by default.
• Public but unlisted — a share link exists, and anyone holding it can open the page. No login, no permission check, no audience list.
• Search-indexed — the same public page, now discoverable by strangers who never had the link.

The move from the first state to the second requires a deliberate user action. The move from the second to the third does not — and that is where this incident lives. Most people reasonably read “anyone with the link” as limited-audience sharing, not as publishing. The gap between those two readings is a design problem, but it is not a leak of private conversations.

Search results really did surface shared chats. WIRED found Claude share URLs appearing in Google and Bing. At the time of writing, WIRED observed Bing reporting “about 612 results” for a site:claude.ai/share query. That figure is an approximate search-engine result estimate observed by WIRED — not a verified count of unique exposed conversations, and it should not be repeated as one.

The technical control was the wrong one. WIRED reported that Anthropic’s robots.txt disallowed crawling of shared chats, but that a sample of the exposed pages carried no noindex tag — the directive both Google and Bing recommend for keeping a page out of results.

Some shared snapshots contained sensitive material. Fortune reported that some of the shared chats included personal information. We do not reproduce any of it. That sensitivity is precisely why a mismatch between what users think sharing means and what it technically does is a real harm, not a pedantic one.

Users were not warned at the moment of sharing. The Guardian reported that neither Google nor Anthropic told users at share time that a shareable link could be indexed by search engines. It also relayed the Electronic Frontier Foundation’s practical point, paraphrased here: privacy that depends on a link staying obscure is fragile, because links get reposted, forwarded and found.

The strongest defence is documented and predates the incident. Anthropic’s share and unshare help page states plainly that chats are private by default, that clicking Share creates a link anyone holding it can view, and that the shared page is a snapshot: messages sent before sharing are included, later messages stay private unless the user re-shares. Attached files themselves and raw tool-call data remain private within the shared snapshot, and users can unshare from Settings › Privacy.

Anthropic’s statement to WIRED made the same point: shareable links are not guessable or discoverable unless a user chooses to share them, and once shared the content is publicly accessible and can be archived by third parties.

Independent reporting corroborates the boundary rather than disputing it. Fortune confirmed that only chats users had intentionally shared were affected, that chats are private by default, and that a shared link does not give access to a user’s account or their other conversations. There is no evidence here of an account compromise, a backend breach, a model breach, or exposure of chats that were never shared.

This part is settled by primary technical documentation, not opinion. Google Search Central states that robots.txt is primarily a crawler traffic-management tool and explicitly that it “is not a mechanism for keeping a web page out of Google.” A URL disallowed in robots.txt can still appear in search results if it is linked from elsewhere. Google directs site owners to noindex, password protection, or removal instead.

That is the crux. The control chosen manages crawling; the goal was preventing indexing. The two are not interchangeable, and Google says so in its own documentation. This is also why the incident should not be framed as something Google did to Claude users: indexing directives are the site owner’s to set.

Scale remains unknown. Search-result counts are estimates, not inventories, and both WIRED and Fortune describe a moving picture: by the time of WIRED’s reporting the relevant Google query no longer surfaced the chats while some Bing results still did, and Fortune reported the Google exposure appeared fixed by publication — though shared URLs stay live for anyone who already has them. Nobody has published a defensible count of unique affected chats, and we are not going to invent one.

The same discipline our method applied to headline error rates in Case 003 applies here: an observed number is only as strong as the thing it actually counts.

Overstated — not “not supported.” The event described is genuine and the underlying design failure is material. What fails is the framing.

• “Private Claude chats leaked” is too broad. It implies private-by-default conversations escaped, which the evidence does not show.
• “Claude’s share-link design allowed sensitive user-shared chats to become searchable” is supported by WIRED’s findings, corroborated by Fortune and the Guardian, and explained by Google’s own indexing documentation.

The honest summary is that a product treated “public but hard to find” as if it were a privacy tier, and did not tell users that the second half of that phrase was not guaranteed. That is a real problem worth reporting. It is a different problem from a leak.

The practical lesson generalises well beyond one assistant. Link-based sharing across chat tools, docs and cloud drives works the same way.

• Assume a share link is public. If you would not post the content, do not create the link.
• Never put credentials, API keys, client data or personal identifiers in a conversation you intend to share as a snapshot.
• Review your existing shared chats in Settings › Privacy and unshare anything you no longer need public.
• Remember snapshots are point-in-time: unsharing removes future access, but anything already copied, cached or archived elsewhere is out of your hands.
• For genuinely sensitive material, use a restricted-access channel with named recipients — not a public URL that happens to be long.

For teams, the policy version is short: link-sharing is a publishing action, and it should be governed like one.