Roughly 600 Claude conversations turned up in Google and Bing this week, and not because anyone broke into Anthropic’s servers. Users clicked Share, which is supposed to hand a link to one person, and the resulting page had no noindex tag on it. So the moment that link touched anything crawlable — a forum post, a tweet, a Slack export — search engines picked it up and filed it away. What got filed included API keys, crypto wallet details, CVs with real names and phone numbers on them, and at least one lawyer’s notes on an ethics case (IBTimes UK, Cybernews). Anthropic patched the tag on the 27th. The cached copies didn’t get the memo.
I don’t do incident response on Claude specifically, but I’ve watched this exact failure play out enough times in client work that I stopped being surprised by the mechanism years ago. Take SharePoint. I’ve lost count of how many small businesses I’ve consulted for where someone hit “Share” on a folder, left the default set to “anyone with the link,” and had no idea that meant anyone — not “anyone who already has the link because I sent it to them,” but anyone who finds the link at all. The sharing controls exist. They’re just built by engineers who understand the permission model, for users who just need to get an invoice to a client by five o’clock and don’t read the dropdown before clicking blue.
That’s the actual failure, and it’s not really about AI. Anthropic didn’t get hacked, and neither did any of my clients. The systems worked exactly as designed. The design just assumed a level of attention nobody under deadline pressure is going to give a sharing dialog. Claude’s problem was a missing meta tag. SharePoint’s problem is a default. Different bug, same root cause: a publish action dressed up as a convenience feature, with no friction between “share with Dave” and “share with Google.”
If a tool of yours has a Share button, treat it as a publish gate until proven otherwise. Check what “anyone with the link” actually means before you use it for anything with a client’s name, a key, or a number attached. Anthropic’s fix stops new indexing — it doesn’t unpublish what already got copied. Neither does deleting a SharePoint link after the fact. Once it’s out, the only real control you had was the click before you shared it.