Hook
On September 12, 2025, a security researcher at Protos ran a simple Google query: site:perplexity.ai/share. The results returned over 1,200 live pages containing sensitive user data—credentials, internal company memos, personal resumes, and even API keys. Claude’s shared links had been indexed just weeks earlier, but by then Anthropic had already patched the issue. Perplexity’s remained open. The difference between these two responses is not just about corporate agility—it exposes a fundamental blind spot in how AI services treat default visibility. For crypto users who rely on these tools for smart contract audits, trading scripts, and vault management, this is not a minor privacy nuisance. It is a structural vulnerability that could leak private keys, strategy code, and on-chain asset control.
Context
Both Anthropic’s Claude and Perplexity AI offer a “share conversation” feature: users click a button, get a link, and can send that link to anyone. The design intention is collaboration. But the implementation overlooks a critical detail—these links are not protected by noindex tags or robots.txt restrictions. Search engine crawlers treat them as ordinary web pages. The result: any conversation that a user intended to share privately with one person becomes discoverable by anyone on the internet. This is not a new problem. OpenAI faced the same issue in July 2025, and after a wave of complaints, added a noindex header. Claude followed suit by September. Perplexity, however, as of the Protos report, still had hundreds of indexed pages live on its own domain.
The scale is significant. Perplexity boasts ‘tens of millions of active users’ and a $20 billion valuation. Claude’s parent company Anthropic is valued at around $60 billion. Both rely on user trust for enterprise adoption—a key growth vector. When a shared link becomes a public data dump, that trust evaporates. For the cryptocurrency community, which uses AI assistants to generate Solidity code, parse on-chain data, and even manage DeFi vaults, the risk is amplified. A shared conversation about a new liquidation bot could expose the exact parameters that a malicious actor needs to front-run.
Core: Technical Analysis of the Leak Mechanism
The root cause is not a bug in the AI models themselves. It is a failure in web application security: shared URLs lack proper access controls and crawler directives. Let’s dissect the architecture.
When a user creates a share link on Perplexity, the system generates a URL like https://www.perplexity.ai/share/XXXXXXXX. The XXXX is a random string—presumably a UUID or a hash. The page is served as a standard HTML document. The server does not set the HTTP header X-Robots-Tag: noindex, nor does it include a tag. Additionally, the site’s robots.txt may not disallow the /share path for all crawlers. Googlebot, Bingbot, and others can freely crawl these pages.
Now, how do search engines find them? A direct UUID is impossible to guess, but they are discovered through backlinks. Users share links on Twitter, Discord, Telegram, or even in public GitHub issues. Crawlers follow these links. Once indexed, the pages appear in search results for queries that match words inside the conversation. For example, if a user discussed “0x1234...5678 deposit” in a shared Claude conversation, that string becomes searchable.
Based on my audit experience at the Zero-Knowledge Proving Ground, I have seen this pattern before: theoretically secure identifiers leak through side channels. The UUIDs are ‘unguessable’, but the chain of human behavior makes them public. The real security failure is the assumption that a random URL is sufficient for privacy. Math doesn’t care about your intent. If it can be crawled, it will be crawled.
A deeper architectural issue: Perplexity’s share pages appear to be generated server-side and stored as static content on a CDN. Once the link is created, there is no authentication required to view it. Anyone with the URL can access the full conversation without logging in. This is by design for sharing, but combined with indexability, it turns every shared link into a permanent public record. Claude’s fix, as reported, was to add noindex headers and request removal from search engines. But that only stops future indexing. Already indexed data remains in Google’s cache for days or weeks—a window of exposure.
The Contrarian angle here is that many security professionals would argue that the real fix should be default-private sharing with mandatory authentication. But that breaks the core use case: frictionless collaboration. Smart contracts execute. They don’t negotiate with the user experience. If we force authentication, the feature loses value. The trade-off is real. Perplexity may have delayed the fix precisely because they wanted to avoid disrupting this workflow.
But the data says otherwise. The Protos researcher confirmed that the indexed pages included “credentials, resumes, internal company information, and personal discussions.” In a crypto context, one could infer that API keys for exchanges, private keys for wallets, and source code for proprietary trading bots have been exposed. The fact that these files are still live on Perplexity’s own domain (not just search cache) means that even if search results are purged, anyone who knows the exact URL can visit it directly. That is a fundamental design flaw.
Contrarian: The Blind Spot of Speed vs. Security
The natural narrative is that Claude (Anthropic) handled this well, while Perplexity dropped the ball. But let’s challenge that. Claude’s quick fix was easier because Anthropic had already dealt with a similar issue from a previous incident. Perplexity may be a younger company with less internal security infrastructure. But more importantly, the Perplexity leak reveals a deeper problem: the site’s architecture may not allow a global noindex policy without breaking core functionality. Perhaps their share feature relies on being indexable for some legitimate use case (e.g., public research publications). That would make the fix a significant engineering effort, not a simple header change.
Furthermore, the crypto community often prides itself on permissionless access and transparency. An argument can be made that if you share an AI conversation, you should assume it is public. The expectation of privacy is naive. But that argument ignores consent: the user who clicks the “Share” button is usually sharing with one person, not the entire internet. The UI says “Anyone with the link can view,” not “Anyone on the internet can view.” That is a breach of user expectation, which is a design ethics failure.
Another contrarian point: search engines are not the only threat. Even if indexing stops, malicious actors can scrape the entire /share/ directory using pattern enumeration. If the UUID generation is not cryptographically random (e.g., timestamp-based), all shared links could be brute-forced. The Protos report did not test this, but it remains a latent risk. Liquidity is an illusion until it’s not. Privacy is only as strong as the weakest link in the chain of custody. In this case, the weak link is the URL itself.
Takeaway: The Vulnerability Forecast for Crypto AI Users
This event is not a one-time bug. It is a systemic symptom of the rapid deployment of AI tools without rigorous security auditing. For the crypto community, the takeaway is clear: treat every AI conversation as potentially public. Never paste a private key, a sensitive contract address, or a trading strategy into any AI chat that has a share feature. If you must, assume that the conversation will be indexed and cached forever. The only safe approach is to use local models or dedicated encrypted services for sensitive work.
Looking forward, I predict that within the next six months, regulatory bodies will mandate that all AI sharing features default to noindex and require explicit user opt-in for search engine visibility. This will increase the cost of building consumer AI products, but it is necessary. The alternative is a continuous stream of data leaks that erode trust in the entire ecosystem. For now, the code is law. And the code says: if you share, assume the world is watching.