Every major AI assistant likely includes a “Share” button. The mental model users hold is a private hand-off, like a link you paste to a colleague. However, the mental model the web holds differs and is worth exploring.
Why AI assistant share links are risky
A share link is an unauthenticated, permanent, crawlable HTTP resource sitting on a high-authority domain. The only things standing between the link and a search index is a header, a robots directive, and a vendor remembering to set both.
In corporate environments, the risk goes beyond “someone shared a link.” The blast radius — how much damage is likely if a user is compromised — depends on what the user has access to before the prompt was written. Although the share link for enterprise licenses is limited, if an over-permissioned employee uses a personal AI account on a corporate device, a single shared conversation or artifact can accidentally carry sensitive files, customer context, code, tickets, or internal decisions into a public and durable surface.
The AI platform becomes the publishing layer, but the organization’s permission model determines how much can leak through it.
The surface
Share endpoints are almost universally a fixed path plus a high-entropy identifier. The entropy defeats brute force — a v4 UUID is not guessable — which is irrelevant. Enumeration never happens by guessing; it happens because a crawler was allowed to fetch the page once. After the fetch, the identifier is in an index, not a namespace.
Claude share links have been indexed by various search engines, a topic that has been trending in the security industry because of its potential impact, but also because of how it was disclosed.
The findings were first discussed publicly on Reddit, which accelerated attention on the issue and prompted broader discussion around responsible disclosure practices. Attention to share links was amplified by similar exposures found in ChatGPT in 2025, and later across other AI platforms, leading many to believe the issue had been addressed industry-wide.
While major search engines reacted quickly and removed the exposed content from indexes, remediation efforts varied among platforms, with some taking longer to fully resolve the exposure.
Nearly every vendor now ships the correct headers. Share pages return , most add X-Robots-Tag: noindex at the edge, none publish sitemaps for the share path, and several disallow it in robots.txt. Run the baseline dorks today and the counts are a fraction of what they were.
“Noindex” is a discoverability control, not an access control. The page still resolves, unauthenticated, for anyone holding the URL.
The archives
The archives are where the story diverges from press coverage. The vendors negotiated with search engines, but almost none of them negotiated with archivists.
The Wayback Machine now excludes the bulk of the share paths for most platforms;Â requests were made, honored, and a large share of captures went dark. However, in some cases there are alternative domains for the same platforms that still work.
For example, https://chatgpt.com/share/* is excluded in the Wayback Machine, while https://chat.openai.com/share/* is not, and still shows the shared pages.
Look at Google: both the full https://gemini.google.com/share/* is excluded in the Wayback Machine, while the short link not excluded — though it is not delivering the content of the pages.
DeepSeek share pages are also still indexed and accessible via Google dorking, as mentioned in the table above.
Grok also has its shared chats indexed and accessible.
The bottom line
The share button in AI assistants was designed for quick collaboration, but in practice, it can behave like a publish button. AI-shared links can remain live for years, appear in public archives, expose sensitive topics via URLs, and survive deindexing or revocation efforts.
For organizations, the risk is not limited to whether a specific platform currently allows public conversations or artifacts. The broader issue is shadow AI usage combined with over-permissioned access. When sensitive organizational data enters personal or unmanaged AI tools, the potential blast radius depends on what that identity could access in the first place. That visibility is rarely monitored — the opposite of what it should be.
Thank you to Mark Vaitsman and Dor Yardeni for their contributions on the topic.
