4,500 ChatGPT conversations. That's the confirmed count of shared chats that Google indexed and made searchable to anyone with a browser. Independent estimates put the real number above 100,000.
The culprit was a small toggle called "Make this chat discoverable" that appeared when users shared a ChatGPT conversation using the built-in Share button. On desktop, it was easy to miss. On mobile, it didn't appear at all, which meant mobile users couldn't see or control it. When enabled, the shared link became crawlable by search engines, and Google dutifully added it to its index.
What People Found
The exposed conversations weren't just casual chats. Security researchers and everyday users reported finding:
- Resumes with full contact details - names, phone numbers, email addresses, home addresses
- Working API keys - at least one ChatGPT API key was sitting in a prompt history, fully visible
- Business strategies and internal documents - company plans pasted into ChatGPT for summarization
- Healthcare billing workflows - medical process details with no access restrictions
One user doing SEO research clicked a ChatGPT link in their search results expecting a useful prompt template. Instead, they landed on someone's deeply personal conversation about relationship problems. The link had been indexed because the original sharer had unknowingly enabled discoverability.
OpenAI Pulled the Feature
OpenAI has removed the "Make this chat discoverable" toggle entirely. In a statement, the company said the feature "introduced too many opportunities for folks to accidentally share things they didn't intend to." OpenAI is now working with Google and other search engines to de-index the conversations that were already crawled.
The standard Share feature still works. Shared links remain view-only and accessible to anyone who has the URL, but they're no longer crawlable by search engines.
The Bigger Problem With AI Chat Privacy
This incident highlights a tension that every AI chat platform faces: sharing is useful, but the line between "shared with a colleague" and "shared with the entire internet" needs to be much clearer than a toggle most people never noticed.
If you've ever shared a ChatGPT conversation, it's worth checking your shared links. Go to Settings > Data Controls > Shared Links in ChatGPT to review and delete any you no longer need. The previously indexed ones may still appear in cached search results for weeks even after OpenAI's de-indexing request goes through.
For anyone pasting sensitive data into AI tools, this is a concrete reminder: treat chat interfaces like public forums unless you've verified otherwise. Enterprise and Team plans have separate sharing controls that prevent public indexing, but the free and Plus tiers had this gap wide open.