A share link from an AI tool is a public web page on someone else's domain, reachable without a login by anyone who has the URL, and reachable by anyone at all if a search engine finds the URL. Shared Claude conversations and Artifacts turned up in Google results this week. Before you write a policy about it, spend twenty minutes running four search operators against your own company name, then revoke what you find at the source. The order matters, because once a page is on a domain you do not control, your options shrink to two, and neither of them is a noindex tag.
What actually got out
Fortune reported on 27 July 2026 (opened 28 July 2026) that users in a Reddit channel had found search phrases returning lists of shared Claude conversations. The exposed material included cryptocurrency wallet keys, names and addresses, work notes, programming discussions and Artifacts. Only conversations someone had deliberately shared were involved. An Anthropic spokesperson said: "These shareable links are not guessable or discoverable unless people choose to share them themselves." The indexing route was closed, and links that had already been exposed stayed live for anyone holding the direct URL. Fortune notes this is at least the third such episode across chat products, after comparable exposure at ChatGPT and Grok.
The precedent is worth knowing because it ended differently. OpenAI ran an opt-in toggle that made a shared chat discoverable by search engines, then removed the feature on 1 August 2025 (opened 28 July 2026), calling it a "short-lived experiment" that "introduced too many opportunities for folks to accidentally share things they didn't intend to". The control had lived at Settings, then Data Controls, then Shared Links, then Manage. Two companies, one opt-in and one not, the same outcome: people did not model a share link as publishing.
Why the fix you know does not apply
On your own site, unwanted indexing has a standard answer. Google's documentation (opened 28 July 2026) gives you <meta name="robots" content="noindex"> or an X-Robots-Tag: noindex header, with the trap that the page must stay crawlable for the rule to be seen: "For the noindex rule to be effective, the page or resource must not be blocked by a robots.txt file." Blocking in robots.txt and expecting removal is the most common self-inflicted wound in this area.
None of that is available to you on claude.ai, chatgpt.com or notion.site. You cannot set a header on a domain you do not own. What you have instead is exactly two levers, and it is worth being clear about what each one does:
- Revoke at the source. Unshare or unpublish, so the URL stops serving content. This is the only lever that removes the underlying page rather than the search result.
- Ask Google to drop the stale result. The Search Console Removals tool (opened 28 July 2026) only works for properties you have verified, and even then "a successful request lasts only about six months". For pages you do not own, Google points to a separate Refresh Outdated Content tool, which asks it to recheck a URL that no longer returns what it did. That tool does nothing until the first lever has been pulled.
Recrawl timing is not on your side either. Google's own guidance is that a revisit "may take months" depending on how important the page looks. So the sequence is revoke first, then request, then accept that the cached snippet may outlive both for a while.
The surfaces to check, and where the control lives
Run each operator with your company name, a product codename, or a customer name in quotes. The paths below are from each vendor's own documentation, opened 28 July 2026.
| Surface | Search operator to run | Where the control is |
|---|---|---|
| Claude shared chats and Artifacts | site:claude.ai "yourcompany" | The share link "contains all messages that were sent prior to sharing". Unshare by switching visibility from Shared to Private on the chat |
| ChatGPT shared links | site:chatgpt.com/share "yourcompany" | Settings, then Data Controls, then Shared Links, then Manage, and delete individually |
| Notion published pages | site:notion.site "yourcompany" | Share, then the Publish tab, then Unpublish. Indexing is a separate toggle called "Discoverable on the web", off by default |
| Google Docs, Sheets and Drive files | site:docs.google.com "yourcompany" | The file's Share dialog, under General access: "Restricted" versus "Anyone with the link" |
Two details in that table deserve more than a row. Notion publishes all subpages automatically when you publish a parent, which is how an internal handbook page becomes a public site nobody meant to launch, and its documentation warns that unpublishing is not enough on its own: if general access is still set to "Anyone on the web with link", the page remains reachable. Google Drive draws the same line more explicitly than most people realise. "Anyone with the link" means "anyone who has the link can use your file, without signing in", while its Public setting is described as "anyone can search on Google and get access to your file". Different guarantees, one dropdown apart.
The three-minute triage for anything you find
Not every hit is an incident, and treating them all as one is how audits stop happening. Sort each result into one of three buckets:
- Contains a credential, key or token. Rotate the credential first, unshare second. The link may already have been copied, and revocation does not un-copy it. This is the same reflex as the one in our unauthenticated endpoint audit: assume anything that was reachable has been read.
- Contains customer or personal data. Unshare, then submit the URL through Google's outdated content route, then log it. If you are covered by a breach notification duty, the clock starts from the moment you know, not from the moment you finish the audit.
- Contains nothing sensitive. Leave it. A public design walkthrough is not a problem, and pretending otherwise trains everyone to ignore the next alert.
The rule worth writing down this week
One sentence, in whatever document your team actually reads: sharing a conversation, document or artifact publishes it, and publishing is a decision with the same weight as pushing to production. Then three checks that make the sentence real.
- Run the four operators above on a calendar reminder, quarterly. It takes twenty minutes and it is the only way to see what left.
- Turn off publishing where nobody needs it. Notion's Enterprise plans have a Settings, then Security toggle labelled "Disable publishing sites, forms, and public links". Removing a capability beats reminding people about it.
- Decide in advance which conversations are allowed to be shared at all. Anything containing a key, a customer record, an unreleased price or an unfiled legal position should be screenshotted rather than linked, because a screenshot has no URL to leak.
Search engines reading your pages is a subject we have covered from the other direction, in setting crawler policy on your own domain, where you hold every lever. This is the inverse case, and the asymmetry is the lesson: the moment content leaves your domain, your control over its indexing is reduced to a request form and a wait. Which is a good reason to be slower with the share button than with the copy button.
Discussion
Sign in with Google or just a name. No email link, no password to remember.