That "Share" Button Is a Data Leak Waiting to Happen

The Claude chats showing up in search results aren't a Claude problem. They're the web working exactly as designed — and most people building on it still don't get that.

By Daniel Nikulshyn, CEO & Founder, WNC

I saw a post this week that stopped me mid-scroll. Someone ran a simple search — site:claude.ai/share — on Bing and pulled back hundreds of strangers' AI conversations. Not hacked. Not leaked through some clever exploit. Just sitting there, indexed, one query away from anyone who thought to look.

And the contents were exactly what you'd fear: API keys and project credentials, resumes with real names and phone numbers and home addresses, internal company details, and personal conversations nobody ever wrote expecting a stranger to read them.

Here's the part I want people to sit with, because it's the whole point: nothing about this was a hack. Nobody broke into anything. The users clicked "share."

The web leaks by default

Everyone's first instinct is to make this a Claude story. It isn't. Rewind to August 2025 — the exact same thing happened to ChatGPT. Google indexed thousands of shared conversations, sensitive stuff surfaced in search results, and OpenAI ended up killing the public-sharing feature entirely to stop the bleeding. Now it's Claude's turn. Next quarter it'll be someone else's.

When the same failure shows up across every major player in an industry, it's not a bug in one company's product. It's the substrate. And the substrate here is the open web, which has one stubborn, thirty-year-old default: anything with a public URL is public. Not "public if you share the link with a friend." Public. As in, a crawler will find it, an index will store it, and a search box will serve it to anyone on earth.

That "share" button feels like handing someone a note. What it actually does is staple your note to a lamppost on the busiest street in the world and hope nobody walks by. Usually nobody does. Sometimes a security researcher runs one search and finds 500 of them at once.

Why smart people paste their whole life into a text box

The deeper issue isn't the crawler. It's the mismatch between how private an AI chat feels and how public a shared link actually is.

A conversation with an AI feels like the most private thing on your computer. It's just you and a text box. You paste in the API key so it can debug your integration. You drop in your resume to sharpen it. You describe the messy internal project because you need help untangling it. In that moment it feels like talking to a colleague with the door shut.

Then you hit "share" to send the thread to a teammate — and in one click that private-feeling conversation becomes a public web page with its own address, waiting to be indexed. The feeling never updated to match the reality. That gap is where all the damage lives, and no amount of "users should know better" closes it, because the interface actively encourages the wrong mental model.

This is the real security story of the AI era

I've said before that the web we're stacking AI on top of is structurally broken, and this is a clean example of what I mean. We're in a gold rush to give AI more access — to our code, our documents, our inboxes, our companies — and we're pouring all of it into tools built on an infrastructure layer whose factory setting is expose everything with a URL.

The models are getting safer every month. The plumbing underneath them is the same leaky plumbing we've had for decades. And attackers know it. You don't need a zero-day when a search operator does the job. The cheapest, most effective "exploit" of 2026 isn't some exotic prompt injection — it's typing site: into a search bar and reading what fell out of everyone else's private conversations.

What to actually do — today

If you use any AI tool, take five minutes and do this:

Audit your shares. In Claude, go to Settings → Privacy → Shared chats, then Manage, and unshare anything that shouldn't be living on the public internet. Do the same housekeeping in every other AI tool you touch. A shared link you created six months ago is still out there right now.

Change your default to "never paste secrets." No API keys, no credentials, no passwords, no full documents with personal data — not into any chat, private-feeling or not. Rotate any key you've ever pasted into one. Treat the text box like a public forum, because the moment you share it, it is one.

If you're a builder, own the mental model. This is the part that matters most to me. If you ship a product, you are responsible not just for what your feature does but for what your users think it does. A "share" button that quietly creates a public, indexable page is a trap, no matter how correct it is technically. Default to private. Make "public" a loud, deliberate, slightly annoying choice. Add noindex where sharing is meant to be link-only. Assume your users feel safe and design for the moment that feeling is wrong.

The takeaway

The companies that win the AI decade won't be the ones with the flashiest demo. They'll be the ones people trust with their data — and trust is built in exactly these unglamorous defaults, the ones nobody notices until 500 strangers' secrets show up in a search result.

At WNC, this is the lens we build through: assume the web leaks, assume your users feel safer than they are, and design so that a single click can never quietly turn a private moment into a public page. That's not paranoia. It's just paying attention to how the thing we all build on actually works.

The web has always leaked by default. AI just gave us far more valuable things to spill.

Check your shared chats. I'll wait.

Daniel Nikulshyn is the CEO and Founder of WNC, an AI product studio. This piece was prompted by the recent reports of shared Claude conversations — following an almost identical episode with ChatGPT in 2025 — surfacing in Google and Bing search results.