New Zealand\u2019s public service has been told, in blunt terms, to stop being \u201cscared of AI\u201d and start using it.<\/p>\n
That directive just collided with an awkward reminder from across the Tasman and beyond: private conversations shared via Anthropic\u2019s Claude chatbot appeared in Google search results, exposing everything from medical records to login credentials. In the AI era, \u201cshare\u201d and \u201cprivate\u201d are proving to be very different words.<\/p>\n
For the public servants now expected to draft policy and summarise reports with AI assistants, for the accountants at small firms pasting client spreadsheets into a chatbot, and for the university researchers running grant applications through Claude, this is not a curiosity story about one chatbot\u2019s bug. It is a governance problem.<\/p>\n
New Zealand\u2019s Privacy Act 2020 puts clear obligations on any organisation handling personal information, and those obligations don\u2019t evaporate the moment an employee clicks \u201cshare.\u201d<\/p>\n
Where the safeguard broke down<\/p>\n
The root cause is a gap between what Claude\u2019s sharing feature promises and what it technically enforces. Clicking \u201cShare\u201d on a Claude conversation generates a public URL meant for sending to one other person \u2014 the interface tells users that anyone holding the link can open it, which sounds like a closed loop. It isn\u2019t.<\/p>\n
Anthropic relies on a robots.txt instruction, in place since roughly September 2025, to ask search crawlers to leave shared-chat pages alone.<\/p>\n
That instruction is a request, not a lock: if a shared link gets posted anywhere else on the open web, Google and Bing\u2019s own crawling rules allow them to index it regardless, unless the page is separately marked \u201cnoindex.\u201d As far as reporting has shown, Claude\u2019s shared pages carried no such tag.<\/p>\n
That loophole is what allowed a basic Google search<\/a> trick \u2014 appending \u201csite:claude.ai\/share\u201d to a query \u2014 to pull up a public archive of conversations and Artifacts (Claude\u2019s term for the interactive apps and documents it generates) that were never meant to be discoverable.<\/p>\n What turned up<\/a> ranged from harmless coding snippets to material with real stakes: clinical data tied to named patients, internal corporate records, staff performance reviews, and live API keys and login credentials.<\/p>\n Anthropic\u2019s position is that it never hands search engines a directory or sitemap of shared chats, and that the links themselves can\u2019t be guessed, meaning exposure occurs only when a user (or someone they sent the link to) posts it somewhere public.<\/p>\n Google\u2019s line was the mirror image: it doesn\u2019t decide what gets published on the web, only whether to honour the crawling instructions a site gives it, and, in this case, it says it did. Neither position is really in dispute; the failure sits in the space between them. The exact search queries that had been surfacing the chats stopped returning results within days, but any individual link already shared elsewhere kept working.<\/p>\n A comparable indexing incident hit Claude last year, and both ChatGPT and Grok have separately had user conversations turn up in search results.<\/p>\n Why it lands differently in Wellington<\/p>\n