Reported Public Exposure of Over 100,000 LLM Conversations via Share Links Indexed by Search Engines and Archived

Across 2024 and 2025, the share features in multiple LLM platforms, including ChatGPT, Claude, Copilot, Qwen, Mistral, and Grok, allegedly exposed user conversations marked "discoverable" to search engines and archiving services. Over 100,000 chats were reportedly indexed and later scraped, purportedly revealing API keys, access tokens, personal identifiers, and sensitive business data.

Risk classification

• Primary risk domain: 2 Privacy & Security
• Primary risk subdomain: 2.1 Compromise of privacy by obtaining, leaking or correctly inferring sensitive information

The incident involved the public exposure and permanent archiving of sensitive personal data, credentials, and internal documents from over 143,000 user conversations.

Additional risk subdomains

• 5.1 Overreliance and unsafe use: Users placed inappropriate trust in the chatbots by pasting highly sensitive credentials, API keys, and proprietary business data into them.
• 4.3 Fraud, scams, and targeted manipulation: The exposed chats documented instances of users leveraging the AI systems to commit academic fraud and cheating.

Causal factors

• Entity: Human
• Intent: Unintentional
• Timing: Post-deployment

The data exposure was caused by human design decisions regarding the 'discoverable' sharing feature and users' unintentional sharing of sensitive information.

EU AI Act risk tier

• Risk tier: 3 Limited Risk

Limited Risk: The systems involved are general-purpose chatbots (ChatGPT, Copilot, Claude, Grok, Qwen, Mistral). According to the definitions, chatbots and AI-generated content systems pose a moderate risk and are subject to specific transparency obligations.

AI system and alleged parties

• AI system: ChatGPT, Claude, Copilot, Grok, Mistral, Qwen (Alibaba, Anthropic, Microsoft, Mistral AI, OpenAI, xAI)
• AI purpose: Chatbot; Writing Assistant
• Behaviour type: Assistant
• Alleged developer: xAI, OpenAI, Mistral, Microsoft, Anthropic, Alibaba
• Alleged deployer: xAI, OpenAI, Mistral, Microsoft, Anthropic, Alibaba
• Alleged harmed parties: Users of Qwen, Users of Mistral, Users of Grok, Users of Copilot, Users of Claude, Users of ChatGPT, General public

Harm severity

Severity ratings are based on this scale.

Highest direct severity in any category: Substantial. Severity is scored from Negligible to Catastrophic in each harm category, for harm the reports describe as caused directly or indirectly by the AI system.

• Physical: direct Negligible, indirect Negligible
• Infrastructure: direct Negligible, indirect Negligible
• Property: direct Negligible, indirect Negligible
• Financial: direct Negligible, indirect Negligible
• Environmental: direct Negligible, indirect Negligible
• Malicious content: direct Negligible, indirect Negligible
• Differential treatment: direct Negligible, indirect Negligible
• Civil rights: direct Minor, indirect Negligible
• Democracy: direct Negligible, indirect Negligible
• Privacy: direct Substantial, indirect Negligible
• Psychological: direct Negligible, indirect Negligible
• Epistemic: direct Negligible, indirect Negligible
• Child sexual exploitation and abuse: direct Negligible, indirect Negligible

Civil rights

Reported: The report explicitly describes a conversation where a user in an Arabic-speaking country criticized their president, which was permanently archived and could be traced back to its creator.

Directly caused: The permanent archiving of political dissent under a conversation that could be traced back to its creator poses a direct threat to their civil rights.

Inferred additional harm: Users in authoritarian regimes whose political dissent was exposed could face severe civil rights violations, surveillance, or arrest if identified by state actors.

Privacy

Reported: The report explicitly describes widespread privacy violations where sensitive personal data, credentials, and internal documents were exposed.

Directly caused: Over 143,000 conversations containing API keys, JWT secrets, resumes, personal emails, and full names were made publicly searchable and permanently archived.

Inferred additional harm: Thousands of additional users likely had their personally identifiable information or proprietary business data exposed in the archived conversations.

People affected

• Occurrences reported: 1
• People reportedly harmed: 100
• People reportedly exposed: 143142

Potential causes

Management

• Prioritizing Features Over Security: Releasing public sharing features without adequate data exposure assessments.
• Lack of Shadow AI Visibility: Management lacked tracking of employee interactions with third-party LLMs.
• Failure to Coordinate with Archives: Management did not request URL exclusions from the Wayback Machine.

Technology

• Discoverable Share Feature: Checking 'discoverable' allowed search engines to index private conversations.
• Crawlable Robots.txt Rules: Robots.txt allowed search engines to crawl share URLs, enabling indexing.
• Metadata Leaks in Shared Chats: Shared links exposed user details like full names and sensitive API keys.

Data Inputs

• Pasting Sensitive Data in Prompts: Users pasted credentials, API keys, and proprietary code into chat prompts.
• Lack of Input Filtering Controls: No automated checks to prevent users from sharing chats with sensitive data.
• Lack of Metadata Redaction: Shared files and prompts retained personal identifiers and sensitive tokens.

Human Factors

• Misunderstanding of Share Feature: Users didn't realize sharing created a permanent, searchable public record.
• Academic Misconduct and Fraud: Students used shared links to document and share academic cheating.
• Oversharing of Proprietary Info: Employees pasted corporate strategies and resumes without considering risk.

Process and Methods

• Low Friction Sharing Design: The 'discoverable' option lacked warnings or secondary confirmation steps.
• Incomplete Cleanup Processes: OpenAI de-indexed Google links but failed to request Archive.org removals.
• Inadequate AI Usage Policies: Organizations lacked clear rules on what data could be input into LLMs.

Information quality

• Classification confidence: High
• Reason for confidence: The reports provide consistent, detailed technical analyses of how the shared links were indexed and archived, including specific numbers of exposed conversations (143,142) and examples of leaked data (API keys, JWT secrets). Multiple independent researchers and sources confirm the findings, leaving very little ambiguity about the mechanism of exposure.
• Ambiguities identified: None of significance; the technical mechanism of search engine indexing and Wayback Machine archiving is well-documented.
• Alternative interpretations: None.

The exposure and permanent archiving of over 143,000 shared LLM conversations represents a significant data leak affecting global users. While the immediate national security impact is minor, the exposure of API keys, corporate secrets, and political dissent in authoritarian countries creates long-term intelligence harvesting risks and individual human rights concerns.

• Overall national security impact: Minor
• Scope: Multiple nations
• Primary target: No clear primary
• Other affected: Multiple nations
• Alleged perpetrator: Unknown

Threat characteristics

• Imminence: Long-term. The data is permanently archived, representing an ongoing vulnerability and long-term intelligence harvesting risk rather than an active, rapidly escalating 72-hour crisis.
• Autonomy: Human-controlled. The incident resulted from human design choices regarding sharing features and user actions in inputting sensitive data, not autonomous AI decision-making.
• Novelty: Evolved capability. While data exposure via search engine indexing is an established threat, leveraging public LLM sharing features to harvest massive conversation datasets represents an evolved vector.

Impact by dimension

• Physical security: Negligible. No physical security threats or critical infrastructure compromises are reported in the incident details.
• Information security: Minor. Exposure of API keys, JWT secrets, and corporate strategies poses information security risks, but lacks evidence of active state-sponsored intelligence compromise or coordinated information warfare.
• Sovereignty: Negligible. No direct threats to state authority, territorial control, or core government operations are indicated in the report.
• Economic security: Minor. Exposure of proprietary corporate strategies and API keys poses commercial risks to companies, but does not threaten national-level economic stability or strategic technological advantages.
• Societal stability: Minor. Significant privacy violations and exposure of political dissenters in authoritarian regimes pose direct risks to individual human rights and safety, though not at a systemic population scale.