In the wild
Realized harm
Over 100,000 shared ChatGPT, Claude, Copilot, Qwen, Mistral and Grok conversations were indexed by search engines and permanently archived
AIR-2025-0069 AIR record · 2025-07-llm-share-link-conversation-indexing
A real party was affected. This incident caused actual consequences, not a demonstrated capability.
From the supporting source
When users click "share" on a ChatGPT conversation, they think they're creating a temporary link for a friend or colleague. What they don't realize is they were also creating a permanent, searchable record of their thoughts, confessions, and sometimes illegal activities seen by Archive.org.digitaldigging.org
The record
Disclosed
2025-07-31
Occurred
2024
Vendor
OpenAI, Anthropic, Microsoft, Alibaba, Mistral, xAI
Product
share features across multiple LLM platforms
Risk domain
Access control and permissions › Credential theft
Also touches
Sensitive data exposure
System type
Generative model
Who acted
AI was the target (contested) — a sharing default plus crawler indexing exposed the conversations
Attack surface
Agent memory
Autonomy level
Assistant
Initial vector
None autonomous action
Impact type
Privacy violation, Information disclosure, Credential exposure
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI03 – Identity and Privilege Abuse
- MITRE ATLAS
- AML.T0012 – Valid Accounts
- NIST AI RMF
- MEASURE 2.7
- EU AI Act
- Article 13
- ISO/IEC
- TR 24028; 42001; 23894
- AIUC-1
- B. Security
- Scope
- tool failure
- Mitigation
- Use secure credential storage; Implement short-lived tokens.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
over 100,000 conversations indexed; roughly 110,000 preserved in the Wayback Machine even after de-indexing, containing API keys, access tokens, personal identifiers and business data
Capability abused
Defense & remediation
Recorded defense
a 'discoverable' opt-in checkbox users did not understand
Guardrail kinds
Unknown
Guardrail outcome
Silent
Fix shipped
OpenAI removed the discoverability option and scrubbed ~50,000 conversations from Google's index — but archived copies persisted
Taxonomy & references
Curator notes
No attacker and no bug — an interface default did all the work, and the mental model of 'share a link with a colleague' did not match 'publish to the indexable web'. The instructive part is the remediation gap: OpenAI could de-index but could not un-archive, so ~110,000 conversations survived the fix. Investigation by Digital Digging with researcher Nicolas Deleur. AI Incident Database incident 1186.
Supporting sources
Cite as
Enkrypt AI. "Over 100,000 shared ChatGPT, Claude, Copilot, Qwen, Mistral and Grok conversations were indexed by search engines and permanently archived". AIR, AIR-2025-0069. https://agentincident.vercel.app/i/AIR-2025-0069/ (accessed 2026-10-19).