A significant data exposure occurred when Claude’s "share chat" and "Artifacts" features resulted in private conversations becoming publicly searchable via Google. Users discovered that employing the search operator “site:claude.ai/share” surfaced sensitive information, including medical records, clinical trial results, internal company documents, and contact details for children. The exposure also included code, work notes, and instances of prohibited sexually explicit content. Anthropic attributed the indexing to third-party platforms, such as forums or social media, where users had posted the non-guessable shareable links, allowing search engine crawlers to archive them. This follows a previous incident reported by Forbes where Google indexed nearly 600 Claude conversations. While Google emphasized that search engines respect site owner directives regarding crawling, the incident highlighted the risks of the "share link" functionality, which makes content accessible to anyone with the URL. Although recent tests suggest the exposure may have been remediated, the event underscores the vulnerability of interactive mini-apps and documents created within the Claude interface. Users can manage their public visibility by navigating to Settings, then Privacy, and selecting Shared Chats to review active links.
Read original
hackernews