Every AI class I teach gets some version of the same question: is my conversation private? I've usually answered yes, and explained that a chatbot processes your words as numeric tokens rather than storing them as searchable text, so there's no realistic way for Google to reconstruct what you typed. That answer was too simple. Last weekend gave me a much better, and more honest, one.
What Actually Happened
On July 25, a Reddit user typed site:claude.ai/share into Google and found hundreds of other people's Claude conversations and Artifacts (Claude's interactive documents and mini-apps) sitting in plain search results. Some of what turned up was mundane. Some of it was not: crypto wallet seed phrases, health information, legal consultations, business documents, and children's names and phone numbers, all fully readable by anyone who searched the right terms.
The mechanism was almost embarrassingly simple. Claude's "Share" button generates a public web page for a conversation, and that page shipped without a noindex tag, the one line of code that tells search engines not to crawl a page. Anthropic's public statement was accurate as far as it went: "these shareable links are not guessable or discoverable unless people choose to share them themselves." That's true. But once someone posted a share link anywhere Google's crawlers could reach, a forum post, a support ticket, a social media reply, the page behind it was fair game for indexing, whether or not the person who shared it understood that consequence. Anthropic patched the missing tag on July 26, and links have been dropping out of Google since. Some were still turning up in Bing days later. And a public GitHub repository had already archived thousands of messages in plain text before the fix landed. A patch stops new exposure. It doesn't recall copies already made.
This Has Happened Before, to Both Major Labs
What makes this worth a full article rather than a passing mention is that it isn't a first-time mistake. In September 2025, Forbes reported that Google had indexed roughly 600 Claude conversations shared through the same feature, despite Anthropic's claim at the time that it blocked search crawlers from those pages. And in August 2025, OpenAI had its own version of this story: a "make this chat discoverable" toggle, meant to help people find useful shared conversations, resulted in nearly 4,500 ChatGPT conversations showing up in Google, some containing detailed discussions of mental health struggles and relationships. OpenAI pulled the feature and said plainly, "this feature introduced too many opportunities for folks to accidentally share things they didn't intend to."
Two different companies, three incidents in under a year, all with the same root shape: a sharing feature that quietly crossed the line from "private link" into "public, crawlable web page," without making that line obvious to the person clicking Share.
Where My Old Answer Was Wrong, and Where It Wasn't
I owe my students and clients a correction, so here it is plainly. Tokenization has nothing to do with what happened. Google didn't reconstruct anyone's conversation from the numeric representations a model uses internally to generate text. It did something far more ordinary: it crawled and indexed a normal public web page, the same way it indexes any other page on the internet, because that page existed and nothing told it not to. The privacy risk here was never about the AI model. It was about a sharing feature and a missing configuration setting, the same category of mistake that has exposed unlisted Google Docs, misconfigured cloud storage buckets, and plenty of other "private by obscurity" links for years.
Here's the part that should actually reassure you: an ordinary Claude or ChatGPT conversation that you never ran through the Share button was not exposed by this. Your day-to-day chatting, drafting, and brainstorming stayed exactly as private as it was before this story broke. The exposure was specific to a deliberate feature, used on purpose, that behaved differently than most people assumed it would.
The Other Half of This Story: Handing Data Over on Purpose
There's a second, related story worth knowing about, because it's not about a bug at all. On July 23, days before the Claude story broke, OpenAI launched Health in ChatGPT nationwide to all US users 18 and older, after a lukewarm limited pilot back in January. The feature lets you connect Apple Health, and medical records from providers using Epic or Oracle Health, directly to ChatGPT, so it can compare lab results over time, summarize changes since your last appointment, or relate your sleep and activity data to how you're feeling. OpenAI says physicians helped build it and that connected health data won't be used to train its models or target ads.
Take that promise at face value for a moment. It still isn't the same thing as HIPAA protection. HIPAA obligates covered entities, your doctor, your hospital, your insurer, in how they handle your medical records. The moment you personally export or connect that data into a consumer product like ChatGPT, it leaves that legal umbrella. What replaces it is a company's voluntary policy, which is real and worth something, but which can change, and which doesn't carry the same legal weight or the same recourse if something goes wrong. That's a meaningfully different kind of decision than the Claude story above. Nobody's Health data got accidentally indexed by Google. The question there is simply whether you want to make that trade at all, and that's a decision worth making deliberately rather than by default.
What This Actually Means for You
If you've ever used a "Share" or "public link" feature on Claude, ChatGPT, or any other AI tool, and posted that link anywhere outside a private message, a forum, a social post, even a Slack channel with more members than you'd expect, go find it and delete or revoke it now. Treat any share link the same way you'd treat publishing a web page, because that is functionally what it is, regardless of how private the interface makes it feel.
For everything else, the conversations you've never explicitly shared, there's no reason to change how you use these tools day to day. That part of the privacy promise held. And if you're considering connecting financial or medical data to an AI assistant, whether that's ChatGPT Health or a similar feature elsewhere, go in with clear eyes about what you're actually trading: real convenience, for a company's policy promise instead of a legal protection you'd otherwise have. I wrote about the related risk of pasting sensitive organizational data straight into a chat window in Before You Paste That Donor List Into ChatGPT, Read This, and the two posts are worth reading together.
None of this means AI tools are unsafe to use. It means the honest answer to "is my conversation private" was always going to be more specific than a simple yes, and I'd rather give you that specific answer than a comforting one. If you'd like help thinking through what your organization should and shouldn't connect to an AI tool, use the contact form to start a conversation.
