This is a research prototype. The data and analyses are preliminary and not yet validated — we'd welcome your .
Security researchers discovered that over 143,000 user conversations from multiple major LLM platforms were publicly accessible via search engines and the Internet Archive. The exposure stemmed from 'share' features that allowed conversations to be indexed by search engines if marked 'discoverable'. This resulted in the leakage of sensitive information, including API keys, personal identifiers, and confidential business strategies, which remain accessible in archived snapshots.
Across 2024 and 2025, the share features in multiple LLM platforms, including ChatGPT, Claude, Copilot, Qwen, Mistral, and Grok, allegedly exposed user conversations marked "discoverable" to search engines and archiving services. Over 100,000 chats were reportedly indexed and later scraped, purportedly revealing API keys, access tokens, personal identifiers, and sensitive business data.
Domain classification, causal taxonomy, severity scores, and national security assessments were LLM-classified and may contain errors.
AI systems that memorize and leak sensitive personal data or infer private information about individuals without their consent. Unexpected or unauthorized sharing of data and information can compromise user expectation of privacy, assist identity theft, or cause loss of confidential intellectual property.
Also classified as
The exposed chats documented instances of users leveraging the AI systems to commit academic fraud and cheating.
Users placed inappropriate trust in the chatbots by pasting highly sensitive credentials, API keys, and proprietary business data into them.
The incident involved the public exposure and permanent archiving of sensitive personal data, credentials, and internal documents from over 143,000 user conversations.
Human
Due to a decision or action made by humans
Unintentional
Due to an unexpected outcome from pursuing a goal
Post-deployment
Occurring after the AI model has been trained and deployed
The data exposure was caused by human design decisions regarding the 'discoverable' sharing feature and users' unintentional sharing of sensitive information.
Added categories peak at 2: Minor (Psychological Harm, Inferred)
The exposure and permanent archiving of over 143,000 shared LLM conversations represents a significant data leak affecting global users. While the immediate national security impact is minor, the exposure of API keys, corporate secrets, and political dissent in authoritarian countries creates long-term intelligence harvesting risks and individual human rights concerns.
The reports describe users interacting with ChatGPT, Claude, and Copilot to write articles, analyze data, and troubleshoot code, which are characteristic of an Assistant. The systems augment human capabilities without taking independent action.
Limited Risk: The systems involved are general-purpose chatbots (ChatGPT, Copilot, Claude, Grok, Qwen, Mistral). According to the definitions, chatbots and AI-generated content systems pose a moderate risk and are subject to specific transparency obligations.
The primary function of the systems (ChatGPT, Claude, Copilot) is acting as conversational chatbots that assist users with various tasks like writing, coding, and answering questions.
The reports provide consistent, detailed technical analyses of how the shared links were indexed and archived, including specific numbers of exposed conversations (143,142) and examples of leaked data (API keys, JWT secrets). Multiple independent researchers and sources confirm the findings, leaving very little ambiguity about the mechanism of exposure.
None.
Technology
Discoverable Share Feature
Checking 'discoverable' allowed search engines to index private conversations.
Crawlable Robots.txt Rules
Robots.txt allowed search engines to crawl share URLs, enabling indexing.
Metadata Leaks in Shared Chats
Shared links exposed user details like full names and sensitive API keys.
Data Inputs
Pasting Sensitive Data in Prompts
Users pasted credentials, API keys, and proprietary code into chat prompts.
Lack of Input Filtering Controls
No automated checks to prevent users from sharing chats with sensitive data.
Lack of Metadata Redaction
Shared files and prompts retained personal identifiers and sensitive tokens.
Human Factors
Misunderstanding of Share Feature
Users didn't realize sharing created a permanent, searchable public record.
Academic Misconduct and Fraud
Students used shared links to document and share academic cheating.
Oversharing of Proprietary Info
Employees pasted corporate strategies and resumes without considering risk.
Process and Methods
Low Friction Sharing Design
The 'discoverable' option lacked warnings or secondary confirmation steps.
Incomplete Cleanup Processes
OpenAI de-indexed Google links but failed to request Archive.org removals.
Inadequate AI Usage Policies
Organizations lacked clear rules on what data could be input into LLMs.
Management
Prioritizing Features Over Security
Releasing public sharing features without adequate data exposure assessments.
Lack of Shadow AI Visibility
Management lacked tracking of employee interactions with third-party LLMs.
Failure to Coordinate with Archives
Management did not request URL exclusions from the Wayback Machine.
AI system involved
Identified by automated extraction; can differ from the alleged developers above.
