Claude Share Links Exposed Hundreds of Conversations with Crypto Wallet Credentials to Google Search
A missing line of code allowed Anthropic's 'shareable link' feature to become publicly searchable, exposing sensitive data including cryptocurrency wallet seed phrases and personal information.
Hidden Conversations Suddenly Searchable
On July 25, a Reddit user performed a routine Google search using the query “site:claude.ai/share” and discovered hundreds of Claude conversations available in plain text. The thread quickly gained traction, accumulating over 4,000 upvotes as users recognized their own shared chats appearing in search results. The conversations were not password-protected or obscured—they were fully readable indexed webpages.
Cryptocurrency Wallets and Personal Data Exposed
Among the exposed conversations were messages containing cryptocurrency wallet seed phrases, the master passwords that grant complete control over digital assets. The breach also revealed apparent Social Security numbers, legal discussions involving professional ethics violations, and other sensitive personal information. Users had assumed their shared links were private or at least hidden from search discovery, not realizing that the “Anyone with the link” designation included search engines.
One Missing Security Instruction
The root cause was a single missing line of code. Claude’s link-sharing feature was intended to function like an unlisted video platform—accessible to anyone given the link, but undiscoverable through search. This protection required adding a noindex meta tag to the HTML, a standard security instruction that tells search engines not to index a page. Although Anthropic had configured a robots.txt file to block crawler access, this proved insufficient. According to Google’s documentation, blocking crawlers does not prevent indexing when URLs appear elsewhere on the public internet. Once share links were posted on forums, social media, or Slack workspaces, Google could discover and index them from these third-party sources without ever accessing the original Claude servers. The same vulnerability affected Claude’s published artifacts feature, exposing payroll spreadsheets, financial dashboards, and other sensitive apps built within the platform.
Source: Decrypt. Not financial advice.