how it happened
- whousersshared chats with a link
- the gapdiscoverable linkscrawlers could read them
- the result~4,500 chats in Googlefeature removed
what everyone assumed
A share link feels like handing someone a key to a private room. The reasonable belief is that sharing is a one-to-one act, that the link reaches the person you send it to and stops there, the way an email or a direct message does. A checkbox labelled “make this discoverable” reads, in the moment of sending, like a step that helps your recipient find what you meant them to see, rather than a step that publishes it to the open web.
what happened
For a stretch of weeks, links that people believed were private were doing exactly what the opt-in had described: becoming discoverable. Not loudly, and not to a recipient, but to the crawlers that index the public internet. The chats sat there accumulating, each one a conversation its author thought was a private exchange, while a search engine read them the way it reads any public page. Some of those conversations carried names, email addresses, resumes, and personal details their authors had shared with what they understood to be a private assistant.
step by step
- users share chats and tick an opt-inMany think a shared link is private.
- the opt-in makes the link discoverableSearch engine crawlers index the chats like any public page.the assumption breaks here
- personal details sit in the open for weeksNames, email addresses, résumés.
- August 2025about 4,500 chats found in GoogleOpenAI removes the feature; some indexed copies linger while caches clear.
how it surfaced
In August 2025, people noticed that a targeted search query returned real ChatGPT conversations, and that roughly 4,500 shared chats had been indexed by Google. OpenAI described the share feature as a short-lived experiment that had introduced too many opportunities for people to accidentally share things they did not intend to, and removed it. Newly shared chats would no longer appear in search results, though some already indexed could linger while caches cleared.
A share control and a publish control can sit one checkbox apart, and the word that separates them can read like a convenience rather than a decision.
“Shared” can quietly mean “published” when the setting that does the publishing is presented as a helpful extra.
picture it at a company like yours
The company here is made up. The other two paths are not: they happened, and each links to the story.
- in this storythe day it mattersA search engine indexes it, and a stranger finds a chat full of client names.what it costs youSomething your team believed was private is now one search away from anyone.
- or it goes like thisit happenedSamsung, 2023howEngineers paste code and notes into a free chatbot to get help.what leavesconfidential code and meeting noteswho ends up with itan AI vendor on consumer terms
- or it goes like thisit happenedDeepSeek exposed database, 2025howThe AI vendor leaves its own database open.what leaveseveryone's chats and the vendor's keyswho ends up with itanyone on the internet
sources
your turn
what you can do about it
this week
Search the open web for your company name alongside the AI tools your team uses, and look at what a stranger can already read.
Someone on your team has pasted work into an AI tool and shared the result, and the share setting that governed where it went was a default or a checkbox nobody paused on. The question the quiet months ask is whether anyone has confirmed what "share" actually does in the tools your people use, and what those tools treat as discoverable.
go deeper
if you're not sure where to start
Run the offboarding checklist on one leaver. It covers every account and token to close when someone leaves.
open the checklist →