Anthropic Just Repeated OpenAI’s Exact Mistake From Last Year — And That’s the Real Story

Most coverage of last week’s Claude chat leak says the same thing. Private conversations got indexed by Google and Bing. Sensitive data got exposed. Go check your privacy settings. That’s true, and it matters. But almost nobody asks the harder question: why did two different AI labs make the exact same mistake within twelve months of each other?

Because they did. Google indexed shared ChatGPT conversations back in the summer of 2025, after users turned on a “discoverable” sharing option. The pages lacked noindex tags, so sensitive content leaked out. A year later, the same failure hit Anthropic. This isn’t just a “Claude problem” or an “AI problem.” It’s a website-configuration mistake that two of the most technically advanced companies on earth both made, in public, back to back. If it happened to them twice, it can happen to your site too. That’s the part worth unpacking.

What Happened, in Plain Terms

On July 25, 2026, Reddit users noticed something alarming. Google had indexed hundreds of publicly shared Claude conversations and artifacts. A simple site search revealed resumes, financial spreadsheets, and even patient names.

Some of what surfaced was worse than a resume. Users on X pulled up API keys, crypto wallet details, a lawyer’s notes on a potential ethics case, and content that looked like Social Security numbers.

By the time Google started pulling the results, someone had already saved more than 11,000 of the exposed messages to a GitHub repository. That detail matters more than most coverage admits. Once a third party archives scraped content, the original company’s “fix” becomes mostly cosmetic. Anthropic patched the issue on Google’s side by July 27, 2026. But Bing kept surfacing results afterward. Third-party scrapes now sit largely outside anyone’s control to remove.

The Real Cause: Robots.txt Isn’t Noindex

Here’s where most coverage lets readers down. Many outlets treat “robots.txt” and “noindex” as the same thing. They aren’t. Confusing the two is exactly what caused this leak.

A robots.txt file only asks crawlers to skip certain URLs. It doesn’t stop those URLs from getting indexed if they show up somewhere else on the web. A noindex tag works differently. It tells search engines, directly, not to list a page in results at all.

Blocking a crawler from reading a page is not the same as telling search engines not to list that page. If a link to a blocked page appears anywhere else — a tweet, a forum post, a random backlink — Google can still show that URL in search results. It just won’t show a description, since it was never allowed to open the page.

That’s exactly what happened here. Anthropic’s robots.txt file already blocked Claude’s share URLs. That sounds like it should have worked. But Google’s own documentation explains why it didn’t: a blocked crawl still allows indexing if the URL surfaces elsewhere on the web. The crawler can’t open the page, so it never sees the noindex instruction sitting inside it. Some exposed conversations even appeared with the label “No information is available for this page.” Google knew the link existed from third-party posts. It just couldn’t read what was on it.

This mix-up trips up developers constantly. Many assume “disallow” and “don’t index” mean the same thing. They don’t. This incident is probably the clearest real-world proof of that gap the SEO world has seen in years. If you run a forum, a document-sharing tool, or any site with public share links, audit this today. Don’t wait for your own version of this story to break.

Why This Keeps Happening: A UX Problem, Not Just a Tech Bug

Here’s my honest take, after watching both the OpenAI and Anthropic versions play out. The real failure isn’t the missing tag. The real failure is simpler: “share with a link” and “searchable by anyone on Earth” are two very different promises. Both companies shipped features that quietly blurred the line between them.

OpenAI’s CISO eventually pulled the feature and called it a short-lived experiment. Many of those chats had already been preserved permanently by the Internet Archive before OpenAI could clean anything up.

When a user flips on “anyone with the link,” most people don’t picture the real outcome: anyone who guesses the right search query, forever, possibly archived on GitHub or the Wayback Machine. That’s a design failure, not just a missing line of server code. It’s also why adding a noindex tag after the fact doesn’t fully rebuild user trust, even once it fixes the technical hole.

Anthropic’s own stance is that the system worked as intended. A company spokesperson said shareable links aren’t guessable or discoverable unless a person chooses to share them. Once someone shares a conversation, the company argues, that person is making it public — just like any other page on the web, and therefore fair game for archiving. That statement is technically accurate. It also assumes users share Anthropic’s own definition of “public.” The last two incidents suggest most users don’t.

A Checklist for Anyone Who Runs a Site With Sharing Features

Skip the “go check your Claude settings” advice — every other outlet already said that. Here’s a practical checklist instead, for anyone managing a site with shareable or user-generated URLs:

1. Don’t rely on robots.txt alone to hide a page. Use it to manage crawl budget, not to block indexing. For real protection, add a noindex meta tag or an X-Robots-Tag header, and make sure the page stays crawlable so bots can actually read that instruction.
2. Audit every “share” or “public link” feature you’ve shipped. If a URL is guessable or gets linked from elsewhere on the web, assume it will get indexed — unless you’ve explicitly blocked that.
3. Separate “shareable” from “discoverable” in your product language. A link one person can send to another is a different risk than a page that shows up in random search results.
4. Treat archived and scraped copies as permanent. Once a page goes public, expect it to land in the Wayback Machine or a scraper’s dataset, no matter how fast you pull it from Google.
5. Default sensitive sharing features to “off,” or use expiring links. Both AI chat incidents started with opt-in features that were easier to switch on than to fully understand.

The Bigger Pattern Worth Watching

Two major AI companies made the same mistake, one year apart, and needed the same fix both times. That’s the story worth following — not another “check your settings” post, but a look at why this entire industry keeps shipping sharing features faster than it ships the crawler rules to match them. If a third AI lab repeats this next summer, it won’t be bad luck. It will be a lesson the industry had two clear chances to learn and skipped anyway.

If you’ve ever shared a Claude or ChatGPT conversation, here’s the simple move: open your account’s sharing settings, review what’s currently shared, and unpublish anything you wouldn’t want sitting in a Google search. For a window last week, that’s exactly what “shared” meant.