The Risks of Shared AI Conversations: Guardrails Every Company Needs in 2026

On 25 July 2026, people found that shared Claude conversations and Artifacts had been indexed by Google — CVs, business documents, medical details, API keys and crypto wallet seed phrases, all reachable with a single search operator. Anthropic added a noindex tag the next day and the results started dropping out. Nothing was hacked. That is exactly the problem: the largest AI data-leak risk in most companies is a share button, pressed by a helpful employee on a personal account.

By Toni Dos Santos, Co-Founder, Spicy Advisory — we help mid-market and enterprise teams actually use the AI tools they’ve bought, tool-agnostically, across the UK and EU.

What actually happened with Claude’s shared chats

Claude, like every consumer AI assistant, has a share button. Press it and you get a public URL you can send to a colleague. The link is long and unguessable, which is why most people treat it as private. It is not private. It is unlisted, and unlisted is a very different thing.

The gap showed up over the weekend of 25–27 July 2026. Here is the sequence.

Anthropic’s position is technically correct. It is also completely beside the point if you are the company whose pricing model, client list or candidate CV is now in a GitHub archive.

Why robots.txt did not save anyone

This is the part worth understanding, because the same mistake is sitting in a dozen other products you use.

A robots.txt disallow rule tells a crawler don’t fetch this page. A noindex directive tells a search engine don’t list this page. They are not the same instruction, and Google’s own documentation is explicit: if a URL is blocked from crawling but appears as a link somewhere else on the open web, Google can still index it. Anthropic had the disallow. It did not have the noindex. So every share link that landed in a public Slack, a tweet, a Discord, a forum answer or a support ticket became an indexable page.

Which means the leak did not require anyone to do anything unusual. Someone shared a link to be helpful, somebody else posted it somewhere public, and a crawler did its job.

This is a pattern, not an incident

In August 2025, OpenAI removed a “make this chat discoverable” option after Fast Company found roughly 4,500 shared ChatGPT conversations indexed by Google, some containing names, CVs and deeply personal reflections. OpenAI’s CISO called it a short-lived experiment and pulled it within days. Eleven months later, the same class of failure at a different vendor, with Grok links caught in the same net.

The pattern repeats because the incentives repeat:

1. A product ships a share feature, because sharing is how AI tools spread inside a company.
2. Users read “share” as “send to one person”, because that is what the word means everywhere else in software.
3. The link escapes into somewhere public, often innocently.
4. A crawler indexes it. Or a scraper archives it. Or both.
5. The vendor patches the surface within 24–48 hours and the story ends for them.

Step five is where companies get caught out. Unsharing a link removes the page. It does not remove the copy that a crawler, a cache, a scraper or a GitHub archive already took. In the Claude case, the archive existed before most people had heard about the problem. Treat any exposed conversation as permanently public and act accordingly — rotate the keys, tell the client, log the incident.

“Every AI incident I have been called into over the last two years started with someone being helpful. Nobody exfiltrated anything. They pasted a contract into a personal account to get a summary, then shared the link so a colleague could see it. The control you need is not a lecture about being careful. It is an account your company owns.” — Toni Dos Santos, Co-Founder, Spicy Advisory

The numbers: how common is this, really

You will see “42% of companies had an AI data leak last year” passed around on LinkedIn. The figure being half-remembered is almost certainly one of these two, both of which are worse.

Put the first and fourth rows next to each other and you have the whole story of AI governance in 2026: roughly two-thirds of organisations have had a leak, and roughly a quarter have a policy that covers it. The gap is not a knowledge gap. Everyone knows pasting client data into a personal chatbot is unwise. The gap is that nothing in the tooling stops it, and nothing in the tooling records it.

Guardrail one: company accounts, not personal logins

This is the single highest-leverage change available to you, and most companies are one procurement decision away from it.

The Claude incident is a clean illustration. On Claude Team and Enterprise plans, conversations can only be shared with other members of your organisation, and viewers must authenticate with their organisation account. Public share links are not available. If a personal account carrying public share links is migrated into a Team or Enterprise organisation, those public links stop working permanently. The entire failure mode that generated last weekend’s headlines simply does not exist on a company plan.

The same logic holds across the market. ChatGPT Business and Enterprise, Microsoft 365 Copilot inside your tenant, Gemini in Workspace: in each case moving from a personal login to a governed seat changes what the tool is allowed to do with your data and what you can see afterwards.

The objection is always cost. Run the arithmetic honestly: a business seat is typically £20–£60 per person per month. One notifiable personal data breach involving client information costs you legal time, a supervisory authority notification, customer communications, remediation and, more expensively, an awkward conversation with your largest account. The seat cost is not the risk. The absence of the seat is.

The practical trap is partial rollout. A company buys 40 Enterprise seats for the departments that asked, and the other 260 people carry on with personal accounts because nobody gave them one. That is not governance, that is a smaller shadow. If you have not read it yet, our guide to shadow AI and enterprise governance risk goes into how to size the problem before you buy.

Guardrail two: permissions, so the blast radius stays small

Company accounts fix ownership. Permissions decide how much damage a single mistake can do. Four settings deserve an owner and a decision this month.

Sharing itself

Decide who can create a share link, and to whom. The default should be internal-only, with public sharing off. If a team genuinely needs public links — marketing publishing an Artifact, for instance — make it a named exception with an approver, not an ambient capability everyone has.

Connectors and data access

Modern assistants connect to Drive, SharePoint, Gmail, Slack, Jira, GitHub and your CRM. Each connection widens what a single prompt can reach. Approve connectors centrally, scope them to specific drives or repositories rather than whole tenants, and review the list quarterly. The same applies to MCP servers and custom tools: keep an allowlist.

Data classification people can remember

Three tiers, one page, real examples from your business:

• Green — fine anywhere: public marketing copy, published documentation, generic drafting and research.
• Amber — company account only: internal documents, unpublished plans, anonymised customer data, code from private repositories.
• Red — never, in any tool, without written approval: personal data of customers or staff, health data, credentials and keys, anything under NDA, anything covered by a client contract that forbids sub-processing.

Agents and automation

Agentic tools act rather than answer. Define what an agent may do without a human in the loop, which systems it can write to, and what always needs sign-off. An agent with a share capability and a mailbox connector is a data exfiltration path with good intentions.

Guardrail three: an AI policy that fits on one page

Long policies do not get read. The version that works is a single page every employee can hold in their head, backed by settings that enforce it. Ten points:

Point seven is the one companies skip, and it is the one auditors and regulators ask about first. Traceability is not a philosophy, it is a list of artefacts: audit logs from your Enterprise tier, exports through a compliance API, spend dashboards per team, a register of AI use cases with an owner for each, and a review meeting in the calendar. If you cannot answer “which tools processed customer data last quarter, and who approved them” in under an hour, you do not have traceability yet.

“The test of an AI policy is not whether it exists. It is whether the settings match it. If the document says no public sharing and the admin console still allows public sharing, you have written a wish, not a control.” — Toni Dos Santos, Co-Founder, Spicy Advisory

For a fuller treatment of the operating model behind this — roles, decision rights, review cadence — see our AI governance framework for mid-market companies and the CISO guide to enterprise AI security.

Where the regulators stand: GDPR and the EU AI Act

GDPR: a share link is a breach, whatever the vendor calls it

The vendor gets to say “this was not a breach of our systems”. You do not get to say that, because you are the controller for the data your staff put in.

• Article 4(12) defines a personal data breach to include unauthorised disclosure of, or access to, personal data. A publicly indexed conversation containing a customer’s name, a candidate’s CV or an employee’s health information is a confidentiality breach on its face.
• Article 33 gives you 72 hours from becoming aware to notify your supervisory authority, unless the breach is unlikely to result in a risk to individuals. “We think it was probably only crawled by bots” is not a risk assessment.
• Article 34 requires you to tell the individuals themselves where the risk to them is high — which is usually the case for health data, financial identifiers or credentials.
• Article 5(1)(f) and Article 32 require appropriate technical and organisational security measures. Letting staff process client data in consumer accounts, with no admin controls, no logs and no retention policy, is difficult to defend as appropriate when you are asked to.
• Article 28 requires a written processor contract. A consumer terms-of-service page is not a data processing agreement. This alone is a reason to move to business plans.
• Article 44 onwards governs transfers outside the EEA, which is where the vendor’s data residency options and your DPA annexes start to matter. We covered the practical side in AI data residency for UK and EU teams.

Enforcement in this area is still finding its shape — Italy’s Garante fined OpenAI €15m over ChatGPT in December 2024, and the Court of Rome annulled it in March 2026 on the jurisdictional point that Ireland’s DPC is lead authority. The lesson is not that nobody is watching. It is that the file moved to a bigger desk.

EU AI Act: the deadline that moved is not the one that matters to you

There was a lot of noise in the first half of 2026 about the Digital Omnibus on AI. Here is the position as it stands after adoption by Parliament on 16 June 2026 and the Council on 29 June 2026:

Note the shape of it. The high-risk regime slipped by sixteen months. The AI literacy duty did not move, and it has been live since February 2025. That is the obligation that covers the employee sharing a client conversation from a personal account — not because sharing is prohibited, but because a company that has not trained its people is failing the one AI Act duty that already applies to virtually everyone. Our breakdown of Article 4 and what AI literacy actually requires has the detail, and you can pressure-test your position with our free EU AI Act check.

UK companies have no AI Act, but they do have the ICO enforcing UK GDPR alongside the Data (Use and Access) Act 2025. The practical requirements land in almost the same place: lawful basis, security, transparency, records. See AI governance and the ICO framework and our guide to the Data (Use and Access) Act for UK businesses.

Your next 30 days

None of this requires a transformation programme. It requires someone senior to own it for a month and a decision to pay for seats. Teams that do this once tend to move faster afterwards, because the answer to “can we use AI for this?” stops being a debate and starts being a lookup. That pattern is what our four-phase adoption framework is built around.