Your Share Button Is an Exfiltration Surface

Over the weekend people discovered that a plain Google search could surface a long list of shared Claude conversations. Some contained medical reports, internal company documents, even names and phone numbers of children. It was quietly remediated by Monday, but the lesson is not about one vendor; ChatGPT had a near-identical episode last year, and Claude itself had a smaller one before that.

Notice what did not fail here. The model did not hallucinate secrets or get jailbroken. The leak came from a “share chat” feature whose interface says “anyone with the link can view,” which most people read as “my colleagues,” not “the entire indexable web.” Convenience and consequence were one click apart, and the default did the damage.

This is the part enterprises keep underestimating. Every AI product now ships share, publish, and “make a public link” features because they are great for growth. Each one is also a data-egress path that sits outside your DLP, your firewall, and usually your awareness. A helpful employee pastes a customer record into a chat, clicks share to get a coworker’s opinion, and a slice of regulated data is now a URL a crawler can find.

The fix is not to lecture people about hygiene; it is to treat these features as governed egress. If you are deploying an AI tool into a regulated-industry customer, the questions are boring and essential. Can public sharing be disabled by policy? Does a shared link get indexed or stay private? Is there an audit of what has already been made public? Can you revoke a link after the fact?

Vendors will keep pointing out, correctly, that the user chose to share. That is true and beside the point. If your safest option requires every employee to perfectly understand the blast radius of a checkbox, you do not have a control; you have a hope. Design the default for the worst-informed click, not the best-informed one.