Claude chats leak into Google, exposing NZ's AI governance gap
Claude chats exposed medical records and API keys in Google search results, revealing a critical flaw in AI-sharing safeguards.
Anthropic's Claude chat sharing feature suffered a critical privacy lapse when sensitive conversations surfaced in Google search results. The exposure included everything from clinical patient data to API keys and corporate records, all accessible via basic search operators like 'site:claude.ai/share'. While Anthropic claims shared links can't be guessed, the damage occurred when users or recipients posted links publicly, triggering search engine indexing despite robots.txt instructions.
New Zealand's government is accelerating AI adoption to cut 9,000 public service roles by 2029, but this incident exposes the governance vacuum. The Privacy Act 2020 obligations remain active even when employees share chats, yet Anthropic's sharing mechanism lacked proper 'noindex' tags. Similar indexing issues have plagued ChatGPT and Grok in the past, suggesting a systemic problem with AI chat sharing features. For public servants and businesses alike, this raises urgent questions about responsible AI tool usage and the adequacy of current privacy safeguards.
- Claude shared chats exposed sensitive data like medical records and API keys in Google search via 'site:claude.ai/share' queries
- Anthropic's sharing feature relied on weak robots.txt instructions instead of proper 'noindex' tags, enabling search indexing
- New Zealand's AI push for government efficiency collided with Privacy Act obligations, exposing governance gaps in AI tool usage
Why It Matters
AI tools are outpacing privacy safeguards, putting organizations at real compliance and security risks when sharing sensitive data.