In early August, news spread about several search engines (Google, as well as Brave, Yahoo, DuckDuckGo, Bing, ...) apparently indexing and making publicly available shared ChatGPT conversations. These conversations could easily be found using a simple dork instruction (site:chatgpt.com/share API) .
After the news broke, Google took down the indexed pages, deactivating the dork. However, some users lately discovered that the shared conversations were still available using Google Gemini or another dork command (site:chatgpt.com/inurl:share).
The first searches revealed thousands of publicly indexed chats, some of which contained sensitive information about trauma, mental health issues, and work-related problems.
What Went Wrong
The exposure was due to the combination of two factors:
- The use of ChatGPT’s “Share” feature
- The enabling of the “Make Link Discoverable” option, which allowed search engines to index the content.
While this setting had to be explicitly enabled by users, many did it without realizing the long-term implications, especially for conversations containing private, emotional, or confidential information.
Dangerous Visibility
Although OpenAI confirmed that it removed the “Make Link Discoverable” feature, and search engines like Google began removing indexed chats, many of these conversations remained accessible using alternate search tools or advanced queries.
Even deleting the shared link did not guarantee full erasure: cached pages, secondary indexes, or AI-powered tools like Gemini may have still displayed portions of the conversation, a major concern for those who accidentally shared sensitive material.
Unfortunately anyone in possession of the link could view the conversation and no ChatGPT account, login, or consent was required.
This means that if the link was available online (because indexed by the search engines), emailed, or shared in a group, it became potentially accessible to anyone who stumbled upon it or forwarded it further, with additional privacy concerns.
Critically, while the author’s name wasn’t shown, any personal information revealed in the conversation remained fully visible and searchable, from names and locations to workplace details and health-related disclosures.
How to Protect Your Privacy When Using AI
We are aware that human error can always occur, but when privacy is at such risk, it is necessary to learn from the mistake to prevent it from happening again in the future and to take advantage to improve our security posture.
Here are some simple but essential precautions:
- Avoid using the “Share” feature, especially for sensitive content;
- If you must share, prefer screenshots or copy/paste the relevant text instead of generating a public link;
- If used, always delete shared links after use to limit their lifetime;
- Never include personal, confidential, or identifiable information in your prompts or replies.
Conclusions
As AI tools like ChatGPT become deeply integrated into our workflows and daily routines, it's easy to forget that data privacy is still a critical responsibility.
Although conversations with AI tools may seem private and secure, a moment of negligence, such as inadvertently sharing information without protection, can create significant privacy issues.
As always, awareness is our first line of defense when it comes to protecting data, assets, and privacy.
Stay Cyber Safe!
