Recent exposure of public Claude shared conversations shows why agentic AI should be operated like business infrastructure, not like a consumer collaboration toy. For companies using AI to manage websites, code, customer communications, marketing, operations, or internal documents, the lesson is simple: custody matters.
The issue was not that AI assistants are useless or inherently unsafe. The issue was that sensitive business work product ended up behind public URLs that could be discovered, indexed, archived, and shared outside the user's intended audience.
That is the exact class of risk self-hosted agentic systems are designed to reduce.
What happened
Claude includes a sharing feature that lets users create a snapshot URL for a conversation. Anthropic's own help documentation says chats are private by default, but once shared, "anyone with the link can view the chat snapshot," including all messages sent before the share event and any artifacts included in that snapshot.
In late July 2026, users and reporters found Claude shared conversations appearing in search results through queries such as site:claude.ai/share. Reports described discoverable conversations involving legal strategy, technical troubleshooting, internal business material, medical discussions, source code, credentials, and personal information.
Some links were later removed from Google search results. But removal from a search index does not automatically revoke the underlying shared URL. Unless a conversation is unshared or revoked server-side, anyone who already has the link may still be able to access it.
A broader security-research writeup also found that public shared-chat links across several LLM products, including Claude, ChatGPT, Copilot, Grok, Mistral, and Qwen, were retrievable through Archive.org. The researcher collected more than 143,000 shared links and found examples of API tokens, AWS access key IDs, and other sensitive data in scraped content. Obsidian Security summarized the broader finding as "143,000 Claude, Copilot, ChatGPT chats publicly accessible."
This was public-by-feature, not hacked
The most important distinction: this was not primarily a model failure. The model did not necessarily decide to leak data. The exposure happened because a convenience feature converted private work into public web content.
That matters because businesses are now putting real operational material into AI chats:
- API credentials and environment variables
- Customer names, email addresses, phone numbers, and support histories
- Contracts, deal strategy, legal questions, and HR issues
- Source code, deployment notes, product roadmaps, and proprietary processes
- Medical, financial, and other regulated or sensitive personal data
When AI chat history lives inside a third-party hosted product, the organization has to accept that product's sharing model, indexing behavior, retention policy, incident response path, and administrative controls. A simple "share" button becomes part of the company's security perimeter.
The issue is not whether AI assistants are useful. They are. The issue is whether business memory should live inside someone else's consumer-grade sharing surface.
Why this matters for website operators
Website management has become more sensitive than most business owners realize.
A modern website operation can include DNS settings, Cloudflare tokens, CMS credentials, Stripe products, customer intake forms, CRM exports, email provider keys, analytics access, SEO strategy, source code, login flows, and deployment instructions. If an operator pastes that context into a hosted AI chat, the chat transcript may become a high-value business record.
That transcript can reveal:
- How the site is hosted
- Which vendors and plugins are used
- Which admin paths exist
- Where the weak points are
- Which APIs and keys control production systems
- What customers submitted through forms
- What the business plans to launch next
For agencies, this is even more serious. One leaked AI conversation can expose multiple clients at once.
How self-hosted agentic systems change the risk profile
Self-hosted agentic solutions such as Hermes change the governance model by changing where the work happens and who controls the records.
Instead of routing daily business operations through a hosted chat product with public sharing features, the agent runs as infrastructure you operate. The agent can still use approved AI models, but the operational layer — files, tools, transcripts, memory, credentials, and automations — remains under your control.
1. No default public share surface
A self-hosted agent does not need to create public URLs to be useful. Its value comes from controlled execution through approved interfaces: terminal, files, GitHub, email, browsers, calendars, messaging platforms, cron jobs, MCP servers, and internal tools.
If a transcript or deliverable needs to be shared, it can be shared through the company's normal channels: email, Drive, Git, ticketing systems, client portals, or private dashboards with proper access control.
2. Local custody of transcripts and memory
Hermes stores session history, durable memory, skills, logs, and configuration under the operator's Hermes profile on the host system. That means the business can decide where records live, who can access them, how they are backed up, how long they are retained, and whether they are ever published.
The transcript is not automatically living behind a vendor's share-link feature.
3. Credentials stay in the operating environment
Agentic work requires secrets: API keys, SSH keys, database URLs, SMTP credentials, Cloudflare tokens, GitHub tokens, and more. In a self-hosted model, those secrets can remain in local environment files, OS keychains, vaults, server secrets, or narrowly scoped tool integrations.
The agent can use tools without turning the resulting transcript into a shareable web page.
4. Tool access can be scoped and audited
A serious agentic deployment should not give every workflow the same authority. Website research, SEO audits, production deployments, email, billing, and server administration should not all run with the same access profile.
Hermes supports profiles, toolsets, command approvals, secret redaction, PII redaction, MCP configuration, and separate operating contexts for isolated work. That makes it possible to separate "research assistant," "website operator," "developer," and "production admin" duties instead of letting every chat become an all-access session.
5. You can choose the model strategy you trust
Self-hosting the agent does not automatically mean every token stays on-prem. If you use a cloud LLM provider, prompts still go to that provider. But a provider-agnostic agent gives the business control over routing.
Sensitive workflows can use approved providers, private endpoints, local models, or different models by task sensitivity. That turns model selection into a security and governance decision instead of a product lock-in decision.
What self-hosting does not magically fix
Self-hosting is not a force field.
If a user copies sensitive data into an email, commits secrets to GitHub, pastes transcripts into a public document, or configures a cloud model without a data-processing review, the risk still exists.
Self-hosted agents reduce the accidental-public-URL failure mode. They still need policy, access control, training, and sane operational practices.
Recommended controls for business AI use:
- Disable or avoid public chat-sharing features in hosted AI tools for business work.
- Use self-hosted agent profiles for sensitive operations.
- Keep secrets in environment files, keychains, vaults, or platform secret stores — not in prompts.
- Enable secret redaction where appropriate.
- Separate personal, business, production, and client-specific agent profiles.
- Use approved model providers by task sensitivity.
- Use local or private models for highly sensitive workflows.
- Retain transcripts according to company policy instead of vendor defaults.
- Treat AI chat logs like business records: searchable, discoverable, and potentially sensitive.
The business case for AI data custody
AI agents are quickly becoming the operating layer for websites, codebases, support, sales, research, and administration. That makes chat history more valuable than ordinary chat logs. It contains the "how" of the business: credentials, infrastructure paths, customer context, pricing logic, vendor details, internal processes, and strategy.
For a company managing websites and digital operations, the safest pattern is not "never use AI." It is: use AI inside infrastructure you control.
Hermes is well suited to that model because it can run locally or on a controlled server, connect to the tools the business already uses, keep durable memory and skills under your custody, and avoid a hosted product's consumer sharing assumptions.
The result is not just more privacy. It is better operational control.
How MOGHQ helps
MOGHQ builds and operates AI-enabled website systems for businesses that need the productivity of AI without surrendering operational control.
That can include:
- Private AI agent workflows for website operations
- Secure automations for content, SEO, support, and reporting
- Self-hosted or controlled-environment agent deployments
- Cloudflare, GitHub, CMS, email, and analytics integrations
- Website audits that identify technical, SEO, and AI-readiness gaps
- Practical governance around credentials, transcripts, and business data
If your company is using AI to manage websites, customer communications, internal documents, or operational systems, the question is no longer whether AI is useful. The question is whether your business data is still under your custody.
Contact MOGHQ to discuss secure AI workflows for your website and operations.
Conclusion
The Claude share-link exposure is a warning about the next phase of AI risk. Sensitive data no longer leaks only through breached databases or misconfigured cloud buckets. It can leak through convenience features that convert work product into public web pages.
Self-hosted agentic systems like Hermes do not eliminate every AI security risk, but they reduce a critical one: losing custody of your conversations, tools, memory, logs, and operating context.
For serious business use, that is the difference between renting an assistant inside someone else's product and operating an agent as part of your own infrastructure.
Sources reviewed
- Anthropic Claude Help Center, "Share and unshare chats", updated June 15, 2026.
- Futurism, "A Whole Bunch of People's Claude Chats Are Publicly Accessible Online...", July 2026.
- Neowin, "Your Claude conversations may have leaked online if you did this", July 27, 2026.
- India Today, "Is Anthropic leaking your chats? Why some Claude conversations are appearing in Google Search", July 27, 2026.
- Julian B. / dead1nfluence, "I scraped every public LLM chat so you didn't have to", August 3, 2025.
- Obsidian Security, "143,000 Claude, Copilot, ChatGPT Chats Publicly Accessible. Were You Exposed?".