They told you not to share your seed phrase. They never told you not to share your ChatGPT conversation.
A single misconfiguration in a robots.txt file. That is all it took. Hundreds of Claude AI chat logs, containing cryptocurrency wallet details, private keys, and login credentials, were indexed by Google. The data is public. The damage, if any has occurred, is still unknown. But the structural flaw is now laid bare for any CTO or risk officer to audit.
This is not a hack. It is a failure of privacy engineering at the application layer. And it exposes a blind spot in the rush to integrate AI with Web3.
Context: The False Promise of Shared Privacy
Anthropic’s Claude, a leading large language model, offers a feature common to the category: a shareable link to a conversation. The assumption is that a user who generates such a link intends to share it with a specific person or group. The expectation is that the link is private by default, public only by explicit, targeted distribution.
This assumption is naive. The internet does not work on assumptions. It works on protocols.
On September 25, an anonymous Reddit user posted a warning (信息点4).
They had discovered that their Claude conversations, which included sensitive wallet details, were appearing in Google search results. The finding was independently confirmed by X user Om Patel (信息点16) and security researcher known as "JG" who discovered wallet details in the index (信息点15). The shared pages were not just metadata. They contained the full text of the conversation (信息点11).
For a crypto user, this is catastrophic. A shared link containing a 12-word seed phrase is a permanent liability. Private keys cannot be rotated like passwords (信息点17). The cryptographic bond is absolute.
The question is not whether this could happen. It already did. The question is why it was allowed to persist, and what it means for the intersection of AI and asset management.
Core: The Forensic Takedown of a Sequence Error
The technical root cause is a classic edge case in crawler configuration. It is a mistake so fundamental that it should be caught by any competent infrastructure audit, yet it persisted for months. Forbes reported on September 5 that hundreds of Claude chats were already indexed (信息点25). That was three weeks before the Reddit post.
Here is the cold, hard sequence of events.
Step 1: The Product Feature. Claude engineers added a "share chat" button. Clicking it generates a unique URL, let's call it claude.ai/share/abc123. The page is live on the internet. Anyone with the URL can read it.
Step 2: The robots.txt Error. Anthropic added a rule to their robots.txt file (信息点5, 6). The intention was likely to prevent crawlers from eating bandwidth on these dynamic pages. The rule they wrote blocked Googlebot from accessing crawling any content under /share/.
Step 3: The noindex Omission. In the HTML of the shared page itself, Anthropic failed to include a tag (信息点5). This tag is the standard web protocol for telling a crawler: "You can read this page, but please do not add it to your search index."
Step 4: The Cascading Failure. A Google crawler encounters a link to the shared page. Perhaps it is a link on a public social media post, or a direct navigation. The crawler goes to claude.ai/share/abc123. Before it can read the page content to find the noindex tag, the crawler checks robots.txt. It sees the blanket disallow rule for /share/. It obeys the rule. It does not download the page content. It does not see the noindex tag.
But the URL itself? The link? That is fair game. Google sees a link to a page, but cannot confirm that the page is supposed to be private. So it does the default action for any unknown, crawlable link: it indexes the URL.
Google’s search result for claude.ai/share/abc123 now shows a snippet. What does a search engine show when it cannot read the page? It falls back to the text it can associate with that URL. The title of the conversation, which the user may have left as "Imported Wallet Recovery" or "DeFi Strategy." The description, often the first sentence. For many of these indexed chats, the snippet was the wallet address itself.
Anthropic’s recommended fix (信息点26) is to allow the crawler to access the page in robots.txt, then rely on the noindex tag. That is the standard, correct order. They should have paused the sharing feature until this was fixed. They did not.
Contrarian: The Paradox of No Confirmed Losses
The official line, as of the article’s writing, is that no theft had been confirmed from this specific leak (信息点22).
This is the most dangerous part of the story.
It creates a false sense of security. The bull case is: "No one lost money, the risk was theoretical, the fix is trivial, move on."
This misses two critical points.
First, the absence of evidence is not evidence of absence. Any competent attacker finding a treasure trove of indexed wallet details would not immediately drain every account. That triggers alarms. A sophisticated actor would analyze the data, identify the highest-value wallets, and wait for the optimal moment. Or, they would use the leaked login credentials to access a centralized exchange account first, using the wallet data as a secondary verification target.
Hype is leverage in reverse. In a bull market, the FOMO to connect wallets to AI agents is intense. Projects are racing to build "AI portfolio managers" (信息点21). This incident serves as a cold dose of reality. The infrastructure is not ready for the hype.
Second, the real damage is to the narrative. The "AI Agent" thesis for crypto rests on trust. You must trust the model not to hallucinate. You must trust the platform to store your API keys safely. You must trust the share link to be private. This incident shatters that trust for a foundational use case: the seed phrase.
ChatGPT already removed its public sharing option a month ago (信息点25), likely anticipating this exact scenario. Claude ignored the warning signal. This is a competitive failure of security hygiene.
Code is law, but capital is king. When private keys hit a public search index, the code is broken. The capital becomes vulnerable to whoever finds the flaw first.
Takeaway: A Due Diligence Checklist for CTOs
Based on my audit experience, from the 0x integer overflow to the Chainlink CCIP reentrancy gap, I can state this with confidence: This Claude incident is a watershed moment for the security architecture of AI+crypto applications.
Every CTO integrating an LLM into a wallet or a trading bot must now ask three questions: 1. Does your AI provider store conversation history by default? 2. Are your shared links protected by noindex and an obligatory authentication layer? 3. Can a user accidentally paste a seed phrase into the chat, and what happens to that data?
The answers, for most current architectures, are: Yes, No, and It's lost forever.
Anthropic will fix this specific bug. Google will de-index the pages. But the fundamental attack surface remains. The shared link is a permanent, globally accessible record of user intent. For a wallet manager, that is unacceptable.
