You think your conversations with an AI stay private.
They don’t always.
Just ask the people who watched their intimate or politically charged exchanges with Anthropic’s Claude appear in Google and Bing search results this weekend. The discovery wasn’t subtle. It started when a Redditor noticed that specific URLs—intended for sharing chat “snapshots”—were sitting right out in the open.
These weren’t just any chats. They included users asking for advice on political party affiliation. Legal questions from Kansas attorneys about whether they must self-report ethical violations. And yes, erotic role-play scenarios.
If you value privacy in the age of generative AI, this is a critical lesson in how web mechanics override good intentions.
The Robots.txt Misconception
Here is the technical reality that most users—and often the companies building these tools—miss.
Anthropic uses a robots.txt file to tell search engine crawlers to stay away from shared chat URLs. This file has been in place since at least September 2024 (the original text cited 2025, which is likely a future-dated error or typo for the current timeline, but the mechanism remains the same). robots.txt is the industry standard for saying, “Don’t scrape this part of the site.”
It works most of the time.
It is not a wall. It is a polite request.
Search engines like Google and Bing are programmed to ignore robots.txt if they find a link to a page elsewhere on the internet. If someone links to that “public” Claude snapshot in a forum, an email, or a social media post, the search engine crawls it anyway.
To actually stop indexing, developers need to use a specific HTML tag.
Why “Noindex” Was Missing
According to WIRED, the leaked chats lacked the noindex meta tag.
Both Google and Bing require this explicit directive. If a page doesn’t have the noindex tag (or an x-robots-tag in the HTTP header), search engines assume the webmaster wants that page indexed and displayed in search results.
“Neither Google nor any other search engine controls what are made public on the web… We give site owners clear controls… and we always respect those directives.”
This is a defensible stance from a search engine. It is less defensible from Anthropic’s side, especially since they faced this same heat last September.
Google spokesperson Ned Adriance told WIRED that indexing is on the site owner. The chat links are public by design. If the URL is accessible, it is indexable.
Microsoft did not comment. Anthropic did not respond.
The Gap Between Privacy and Indexing
The core issue here isn’t malicious intent. It’s a collision of features.
Claude allows users to generate public URLs to share conversations. This is useful for collaboration. But generating a public URL triggers standard web indexing behavior unless explicitly blocked at a deeper level.
Most users assume that “shared” means “private link only.” It doesn’t. In the world of SEO, “public URL” equals “potential search result.”
This happened to Bing, which still showed around 612 results for site:claude.ai/share when reported. Google’s results for the specific “share” query seem to have cleared up after WIRED reviewed them, likely after the links were deleted or updated.
But the data is out there. Cached copies exist. The lesson is stark for anyone using AI chatbots for sensitive topics:
- Assume nothing is truly private.
- Public URLs are indexable by default unless technical safeguards are correctly implemented.
robots.txtis not enough. You neednoindex.
AI labs claim they respect crawler rules. They do. But they rely on developers to use the right rules. If the implementation is flawed, your erotic role-play history ends up on a search engine results page.
And you can’t un-google it.
The broader implication? As AI agents become more integrated into daily life—from smartphone-controlled workflows to government token usage—the attack surface for privacy leaks expands. We are building systems that talk back to us, while the open web indexes every conversation.
Who controls the index? Who owns the memory?
Probably not you.
