Two days ago, a security researcher ran a routine search query. The result: thousands of user conversations from Claude and Perplexity indexed by Google. Plaintext credentials, resumes, internal company discussions—all publicly cached. Claude fixed the issue within hours. Perplexity’s files remain live on its domain. The ledger remembers what the ego forgets.
This is not a zero-day exploit. It is a product design oversight: shared links without a noindex tag. A simple HTML meta tag that tells search engines to skip a page. Missing in action across two leading AI services. The same flaw hit OpenAI in July 2025. The industry has a blind spot.
Context: How Share Links Work
Claude and Perplexity offer share functionality: users generate a URL to share a conversation or a “computer access” output. The intent is private collaboration—only those with the link can view. But “anyone with the link” includes Googlebot. Without noindex, the search engine crawler treats the page as a public resource. It indexes the full content, including user inputs.
Perplexity’s UI displays: “Anyone with the link can view.” It does not say “Anyone on the internet can view via search.” This is misleading. The user perceives privacy. The reality is public exposure. Claude had the same issue. Both companies knew the mechanics of link sharing. Both neglected to implement a basic privacy guard.
OpenAI faced identical criticism months earlier. The recurrence suggests a systemic failure: AI product teams prioritize speed and collaboration over default privacy. The assumption that a random UUID is sufficient to prevent indexing is naive. Search engines find links through direct submission, cross-referencing, and even brute-force crawling of short UUID spaces. The attack surface is larger than most engineers assume.
Core: The Vulnerability Anatomy
Let’s break down the mechanics. A share link is a URL like perplexity.ai/search/abc123 or claude.ai/share/uuid. The page contains the full conversation text. The HTTP response headers lack X-Robots-Tag: noindex. The HTML lacks . The robots.txt file does not disallow the share path. Result: Google indexes the page.
The exposure is not limited to search cache. Perplexity’s files are accessible directly on perplexity.ai. Even if Google later removes the index, the underlying server still serves the content to anyone with the direct URL. That URL can be shared on Reddit, Telegram, or archived by the Wayback Machine. The data leak persists beyond any search engine de-indexing.
Based on my experience auditing ERC-20 contracts, this is equivalent to deploying a public mint function without an owner-only modifier. The omission is simple, the consequence catastrophic. Code does not lie, but it does obfuscate—in this case, the missing noindex tag is the invisible vulnerability.
The researcher Protos documented multiple examples. One indexed conversation contained a user’s API keys for a cloud provider. Another held a resume with phone number and home address. Corporate internal discussions with financial projections. These are not edge cases. They are the natural output of users who trusted the platform’s implied privacy.
Perplexity’s case is more severe. The search results show pages from perplexity.ai with snippets containing user queries. The same domain that powers its paid “computer access” feature. That feature involves automated operations on user data. If those outputs are indexed, the exposure includes execution logs, credentials, and maybe even file uploads. The surface area is larger than a standard conversation.
Claude’s quick fix—adding noindex and requesting search removal—does not fully undo the damage. Google’s cache can persist for days or weeks. And the data may have been scraped by third parties before removal. But the response speed differentiates the two companies. Claude acted within hours of the report. Perplexity, as of writing, has not publicly acknowledged the issue, and its files remain indexable.
Contrarian: The Real Risk Is Not Search Indexing
The narrative focuses on search engines. That is the symptom, not the root cause. The real risk is the architecture of trust in link-based sharing. AI services treat a URL as a permission token. No authentication, no expiration, no audit trail. If a user copies a share link to an email, that link can be forwarded, posted, or crawled. The link itself is the key. And that key is static.
In blockchain, we avoid static keys for value-bearing operations. We use time-locked, signed, or multi-sig mechanisms. AI services are years behind. They emulate the old web’s share-by-link model—convenient but insecure. The contrarian insight: the missing noindex tag is merely the tip. The underlying issue is that AI platforms treat user data as second-class assets.
Perplexity’s UI says “anyone with the link can view.” That statement is technically correct but ethically incomplete. It does not disclose that “anyone with the link” includes bots, archives, and future employers. The user is not informed that sharing a link is equivalent to publishing the conversation on a public blog. Alpha hides in the friction of chaos—here, the friction is the user’s false sense of privacy.
The industry’s response will likely be additive: add noindex, add authentication. But that is a band-aid. The structure of static URLs remains. A better approach: encrypt share link content at rest and require an ephemeral token to decrypt. Standard in encrypted messaging apps (Signal, WhatsApp). Absent in AI collaboration tools. Until this structural change happens, every share link is a potential liability.
Moreover, the real damage may come from aggregation, not single exposure. A user might have dozens of indexed conversations. Combined, they form a profile. Search engines can surface them via specific keywords. An employer searching an applicant’s name on Google could find the applicant’s AI chat about salary expectations. The privacy violation is not single-point; it is systemic.
Takeaway: A Call for Default Privacy
The events of the past two days should force every AI product team to audit their share link implementation. The checklist is short: add noindex to all share pages, configure robots.txt to disallow share paths, consider using short-lived signed URLs, and—most importantly—default to private. Let the user opt in to public indexing, not out.
For users: never share sensitive data via AI chat links. Assume any link you generate is public. Use dedicated secure communication channels for credentials or confidential business information. The convenience of AI’s share feature is a trap.
Looking forward, I expect regulators in the EU and California to scrutinize this pattern. The GDPR’s principle of data minimization and security requires that platforms protect data at rest and in transit. A share link that can be indexed by default violates that principle. We may see fines or mandated privacy redesigns within the next 12 months.
Perplexity’s valuation of $20 billion is built on growth and trust. This event chips away at both. The company must act quickly—not just to remove the indexed content, but to rebuild the trust structure. The ledger remembers what the ego forgets. In security, there are no second chances.
In DeFi, a missing access control can drain a liquidity pool. In AI, a missing noindex tag can drain a user’s privacy. The code does not lie, but the omission does. The question now is: how many other share links are waiting to be found?