Hundreds of private AI chats just showed up on Google

In late July, Reddit users noticed something unsettling: typing a simple search operator into Google surfaced page after page of other people's conversations with Claude, Anthropic's AI assistant. Wired, Fortune, and TechCrunch each dug through the results and found a detailed medical report on a named patient, clinical trial results listing patient names, documents containing the names and phone numbers of primary-school-aged children, a crypto wallet's keys, and, in a case that will make any practitioner wince, a lawyer asking the chatbot whether they had to self-report a breach of professional conduct.

Nobody was hacked. That's the part worth sitting with.

What actually happened

Claude, like most consumer AI tools, has a share button. Click it, and the tool creates a public web link: a snapshot of your conversation you can send to a colleague. The interface warns that "anyone with the link can view" the chat.

What it doesn't say is what "anyone" means on the open internet. A public URL with no instruction telling search engines to stay away is a page like any other. Post it in a forum, a Slack channel that gets archived, a shared doc, anywhere a crawler can see it, and Google will index it. So it did, for hundreds of conversations.

Anthropic's response was, essentially, that the feature worked as designed: users chose to make those chats public. And they're not wrong. This isn't a story about one careless vendor. OpenAI went through a nearly identical episode with ChatGPT's shared links, and so did xAI's Grok. It's a story about what consumer AI tools are: websites, where your conversations live on someone else's servers, one click away from the public web.

For most people, that's a manageable risk. For a practice that handles client files, patient records, or privileged questions, it's a different calculation entirely. The people whose medical reports showed up in those search results almost certainly thought they were sharing a link with one colleague. The gap between what they intended and what they did was invisible until it wasn't.

Why this failure mode doesn't exist on a Marling device

Marling is a small device that sits on your office network. Your staff open a chat window in their browser and work the way they would with any AI assistant. But the architecture underneath is different in ways that matter for exactly this scenario.

There is no public link to leak. Marling isn't a website. It runs on the device in your office, reachable only from your own network. When someone on your team shares a conversation, the link they share only works for people who can already reach the device, meaning people inside your practice. There's no public snapshot on the open internet, so there's nothing for Google to crawl, nothing to index, nothing to stumble across. The entire category of "shared chat ends up in search results" has no equivalent here.

Identifiers are stripped out of anything that goes to a cloud model. Marling still uses frontier models, including Claude, to do the heavy lifting. But before a request leaves the device for one of those models, names, record numbers, and other identifiers are detected and masked on the device itself, then restored in your finished draft. If the masking can't run, the message doesn't send. The work that doesn't need a frontier model, like searching your own uploaded documents, is handled on the device and never leaves at all. So the traffic that does reach a cloud provider doesn't carry the details that made those leaked chats so damaging. A medical summary without a patient's name in it is a very different thing to expose than one with it.

One person's slip isn't a silent one. In a consumer tool, every staff member has their own account, their own sharing settings, their own habits, and you have no visibility into any of it. Security researchers have a name for this: shadow AI. Marling is one shared, governed device for the whole office, with roles and an audit trail. The tool your team actually uses is the one you can actually see.

The honest caveat

No system makes data leaks impossible, and anyone who tells you otherwise is selling something. A screenshot can always be emailed; a draft can always be pasted somewhere it shouldn't go. What architecture can do is remove the traps: the innocent-looking share buttons whose consequences only become clear when your client's file is on page two of a Google search.

That's the standard we think tools for regulated work should meet: not "be careful," but "the careless path doesn't lead anywhere dangerous." It's also a standard we hold ourselves to: while writing this piece, we went and audited our own product for the same shape of risk, on the internal machines we test on before anything reaches a practice. Here's what that audit caught, before it ever became anyone's problem.

If this is the anxiety you've been carrying

You're probably already using AI in your practice, quietly, and holding back the real work because of exactly this kind of story. That instinct is correct, and it's also why we're building Marling. We're currently working with a small group of founding design partners who use it in their real work and tell us what helps.

If that sounds like you, we'd like to hear from you: hello@marling.io.