AI 安全與隱私
Claude Public Share Pages Enter Search Indexes: “Visible Only to Those With the Link” Does Not Mean Undiscoverable
Some Claude conversations and Artifacts intentionally shared by users have appeared in Google search results, turning content that seemed limited to link holders into material discoverable by keyword. This was not a breach of unshared private conversations, but it exposes a security gap between public links, crawler controls, and user expectations.
Claude’s public-sharing mechanism has recently produced a privacy incident worth the attention of AI product engineering teams: public URLs for user-created conversation snapshots and Artifacts were indexed by Google and could be found through queries such as `site:claude.ai/share`. As of July 27, Axios could still find some Artifacts, including business plans, cloud architecture diagrams, and clinical trial planning documents, although it could not verify whether the information in them was genuine. Anthropic said private conversations are not made public automatically and that it did not provide search engines with a directory or sitemap of shared pages. A URL would first have to be posted by a user to a forum, social network, or another crawlable location before a search engine could potentially discover it.
Technically, the core issue is not that a model or account was compromised, but that “public but difficult to guess” was mistaken for access control. A high-entropy URL can only reduce the probability of brute-force guessing; it cannot prevent third parties who obtain the URL from reposting it, nor can it stop web crawlers, browser extensions, archival services, or logging systems from spreading the content. `robots.txt`, HTML `noindex`, and `X-Robots-Tag` are also merely cooperative indexing policies, not authorization mechanisms. If crawlers are blocked from reading a page, they may be unable to see its embedded `noindex` directive and may still retain the URL based on information from external links.
Anthropic’s documentation explicitly states that, for individual plans, once a conversation is shared, the messages and Artifacts present when the snapshot was created are visible to anyone with the link. The attachment files themselves and raw response data from MCP tools are not included in the snapshot. Sharing on Team and Enterprise plans is restricted to the organization. Engineering teams should treat share links as public publication and protect sensitive output with authentication, expiration times, revocable tokens, and organization-scoped ACLs. Interfaces should also clearly distinguish between “accessible to anyone” and “searchable.” De-indexing cannot recall copies that have already been downloaded or archived, so existing users should audit their privacy settings and revoke share pages they no longer need.