A new round of reporting has highlighted an important privacy lesson for anyone using generative AI tools: content shared from Claude through a public link was discovered in search results after those links became visible on the open web. Reported examples included chats and artifacts containing health-related information, internal business documents, names, phone numbers, API keys, and other sensitive data. The issue appears to center on shared links and published artifacts — not all private Claude conversations — and serves as a strong reminder that “anyone with the link” should be treated as potentially public.
If you use AI tools, take these steps before you share output:
- Do not include confidential, regulated, or personal information in prompts or files unless the tool is approved for that data.
- Treat anyone with the link as effectively public.
- Remove names, phone numbers, IDs, financial details, internal-only material, and other sensitive content before sharing.
- Never include passwords, API keys, tokens, or access codes in chats or artifacts.
- Review previously shared Claude chats or artifacts and revoke access to anything that should not remain available.
Learn more about protecting sensitive information when using AI tools by visiting the OIT Information Security Learning Library.