Hook
It started with a frantic Reddit post on July 25, 2025. A user, let’s call him Alex, discovered that a private conversation he had with Claude—where he had pasted his entire resume, salary expectations, and a detailed account of his job search—was showing up on Google’s first page. Not as a vague snippet, but as the full, unredacted text. He hadn’t published it; he had simply clicked “Share” to send the link to a friend. The link, designed to be known only to those with the URL, had been silently cataloged by the search engine giant. Alex’s shock turned to horror when he realized that anyone searching for his name or company could now read his most sensitive career secrets. He was not alone. Over the following weeks, a cascade of similar reports emerged. Claude, Perplexity, and even OpenAI had been leaking user data—not through a hack, but through a design flaw as subtle as a missing line of code.
Context
This is not a story about sophisticated cyberattacks or state-sponsored hackers. It is a story about the quiet failure of centralized trust in the age of AI. The services in question—Anthropic’s Claude, Perplexity AI, and OpenAI’s ChatGPT—allow users to share conversations with others via a simple link. The intention is collaboration: you can share a chat with a colleague, a debugging session with a developer, or a therapy session with a friend. But the implementation was flawed. These sharing endpoints lacked the noindex meta tag, a simple HTML instruction that tells search engine crawlers to ignore the page. Without it, Google and Bing treated these private links as public web pages, indexing them into their vast databases. The result was a massive, unintentional data breach of personal information: resumes, login credentials, internal company discussions, and even API keys.
For Claude, the problem was first noticed by a security researcher and quickly escalated. By the time Forbes published its exposé in September 2025, Anthropic had already implemented a fix and worked with search engines to remove the indexed pages. Perplexity, however, remained exposed. At the time of the report, its shared links were still fully accessible on the live site and in search results. OpenAI had a similar incident in July 2025 but resolved it quickly. The pattern reveals a systemic industry blind spot: a race to ship collaborative features without considering the foundational privacy implications.
Core
Let me dissect this from the inside. I’ve spent years auditing smart contracts and designing decentralized systems. The same ethical forensics I applied to DeFi protocols now apply to AI sharing mechanisms. The root cause is a violation of least privilege: a link that is intended for a specific person should not be accessible to an unrestricted automated crawler. The fix is trivial—add to the page header, or restrict access via authentication. But the deeper issue is philosophical. These companies operate on a model of benevolent centralization: they hold the keys to your data and promise to protect it. But when a single missing tag can expose your deepest secrets, the promise rings hollow.
Perplexity’s current state is particularly alarming. According to the investigation, the leaked data resides not just in search engine caches, but on perplexity.ai’s own servers, accessible to anyone who knows the direct URL. This is not a caching issue; it’s a fundamental access control failure. The company’s “Share” interface misleadingly states “Anyone with the link can view,” while in reality, any web crawler or curious user can view it without the link—simply by navigating the indexed structure. This is a breach of informed consent. The user never agreed to have their conversation indexed by the world’s largest data aggregators.
Based on my audit experience with the EtherTrust contract, where a reentrancy bug could have drained millions, I know that the difference between a secure system and a leaky one often comes down to a single assumption. In EtherTrust, the developers assumed that external calls would not execute malicious code. Here, the developers assumed that search engines would not crawl shared links. Both assumptions were catastrophically wrong. The lesson is that trust in a centralized entity’s competence is not a security strategy.
Contrarian
Some might argue that this is a minor bug—easy to fix, and not a true data breach because no external attacker broke in. The data was already public, just not widely known. This reasoning is dangerously myopic. First, the data was not public by intent; it was public by negligence. The distinction matters ethically and legally. Under GDPR, for example, data must be protected by ‘appropriate technical measures’—and omitting a standard noindex tag can hardly be considered appropriate. Second, the existence of a fix does not undo the damage. Claude removed the indexed pages, but cached copies remain in Google’s database for days to weeks, and third-party archives like the Wayback Machine may have captured them. Once a secret is spilled into the public domain, it can never be fully contained.
Moreover, this incident reveals a deeper structural vulnerability. AI conversations often contain the most intimate details of a user’s life—health issues, financial struggles, creative projects, private thoughts. They are the digital equivalent of a therapist’s notebook. Centralizing this data in plaintext on a server, even temporarily, creates an irresistible target for attackers, insiders, and automated crawlers. The contrarian view that “it’s just a small leak” ignores the compounding risk of many small leaks across the industry. As AI adoption grows, the volume of shared conversations will explode, and so will the surface area for accidental exposure.
Takeaway
The path forward is not to abandon sharing—collaboration is essential—but to rebuild the architecture on principles of self-sovereign identity and verifiable credentials. Blockchain technology offers a blueprint: instead of trusting a centralized server to protect your data, you control it cryptographically. Imagine an AI sharing protocol where you generate a time-limited, revocable credential that grants access to a specific conversation, encrypted end-to-end. The link itself is not a URL on a company’s domain but a pointer to encrypted storage that only the holder of the private key can unlock. No centralized server holds the plaintext, so no leaked link can expose your secrets.
This is what I meant in my Proof of Soul manifesto: in an age of AI-generated media and automated surveillance, cryptographic identity is the last bastion of human autonomy. The Claude and Perplexity leaks are not just privacy incidents; they are a clarion call to move from permissioned trust to permissionless sovereignty. The tools exist: decentralized storage (IPFS, Arweave), zero-knowledge proofs, and blockchain-based identity. What’s missing is the will to prioritize user dignity over shipping features.
The next time you click “Share” on an AI conversation, ask yourself: who else might be reading? The answer, today, is the entire internet. Tomorrow, it can be no one but you and the person you choose.
— The Ghost in the Code
— The Illusion of Permissionless Freedom
— The Fragility of Provenance