Anthropic’s Claude Share Links Indexed by Google Expose Sensitive User Data
What Happened — Reddit users discovered that public URLs generated by Claude’s “Share” feature were being crawled and indexed by Google (and Bing). The searchable links revealed a range of sensitive material, including cryptocurrency wallet keys, personal identifiers, work notes, and policy‑violating content. Anthropic has removed the indexing issue for new links, but previously‑shared URLs remain publicly reachable.
Why It Matters for Compliance & Audit Readiness
- Demonstrates a real‑world violation of SOC 2 CC6 (Privacy) where data thought to be private becomes publicly discoverable.
- Highlights the need for continuous monitoring of data‑sharing controls and evidence that public‑exposure safeguards (robots.txt, no‑index headers) are enforced.
- Aligns with Verisq’s CookiePLUS capability: automated consent, DSAR readiness, and privacy‑control mapping that can be presented as audit evidence.
Who Is Affected — SaaS AI providers, enterprise users of generative AI (tech, finance, healthcare, legal), and any organization that shares AI‑generated content externally.
Recommended Actions
- Review and restrict use of “share” links; treat them as public web content and apply the same classification as any external publication.
- Map the incident to SOC 2 CC6 controls (privacy notice, data minimization, third‑party risk) and capture remediation steps as continuous evidence.
- Deploy CookiePLUS to enforce consent, manage data‑subject requests, and generate audit‑ready privacy reports.
Technical Notes — The exposure stemmed from a misconfiguration of the share‑link endpoint that allowed search engine crawlers to index the URLs. No CVE was disclosed; the issue was a design flaw in the public‑link generation process. Source: Malwarebytes Labs