What OpenAI described as a “short-lived experiment” is now over, as the company will no longer allow Google and other search engines to index certain types of ChatGPT conversations.
This “experiment” was not formally announced, and general public awareness of it came at the end of July via a Fast Company article. The reporters discovered that ChatGPT conversations that were clearly meant to be private, such as exchanges about physical abuse episodes and mental health struggles, could be uncovered via search engines with some minor URL manipulation.
ChatGPT conversations now blocked from search engine discovery
It is not clear exactly when OpenAI opened up the contents of ChatGPT conversations to search engines, but the Fast Company report (published on July 30) found over 100,000 instances that could be accessed by entering a portion of a common URL.
The “experiment” did not include all ChatGPT conversations, but only those in which a user opted to use the “Share” function to generate a URL to allow someone else to view the exchange. The intent of this function is to create a URL that is at least semi-private, akin to a shared link to a Google Doc meant only for specific collaborators. But the researchers found that entering a common portion of the Share URLs into Google would return sprawling lists of indexed conversations, and that the contents of some of these make clear that the users likely did not intend for them to be open and available to the world in any way.
The ChatGPT conversations that were exposed were not tied to a specific user identity, but also did not appear to be filtered for potentially identifying information that the user included in the chat. An X statement by OpenAI CISO Dane Stuckey indicates that the company was aware of the indexing and thought it might facilitate discovery of “helpful conversations,” but that it has rethought the feature and is working with search engines to have the conversations de-indexed.
Initial reports were that only about 4,500 ChatGPT conversations were exposed, but that number has since been revised significantly upwards after a deeper dive by reporters with 404 Media. In addition to conversations about sensitive medical issues, the researchers have found confidential business contracts that were uploaded for analysis and even a copy of a non-disclosure agreement for an OpenAI employee. Some chats contained names and personal details sufficient to identify the user.
Search engines will grab any publicly linked chat URLs
The share button captures ChatGPT conversations up to the point the button is pushed; entries after that point will not be included in the viewable log without creating a new URL. Users can then toggle whether or not the link is “discoverable.” OpenAI claims that it made clear in these instructions that the chats might be discovered by other parties, but users say it was not at all clear that they would be open to indexing by search engines (with the only apparent warning about this possibility appearing in a small grey font).
The ability to generate share links is still relatively uncommon among the major chatbot models, particularly those that can be indexed; the feature is more likely to be found in business tools with AI components such as ZenDesk and HubSpot. Each platform has their own quirks of potential exposure that have to be carefully watched for, however, as Meta demonstrated several months ago. Meta AI’s “discover” tab was found to be haphazardly sharing user conversations that the users were apparently not aware could be shared in this way, forcing the company to tweak it to only display those created by or approved by staff.
Even if ChatGPT conversations or those of other LLMs are not indexed, users must also be careful about sharing links in any sort of place that search engines can reach. Some employees may be under the errant belief that sharing via a social media account that is too small or obscure to gain public attention will keep the link from being indexed. Some platforms, such as X, now incorporate their own AI models that may take up the contents of shared links if privacy settings and terms of use are not carefully checked. There is also the more general and established risk of any information fed into a chatbot, such as PII or confidential business information, essentially entering an opaque box that it cannot be retrieved from and that may resurface unexpectedly somewhere else in the future.
Awareness of these possibilities is particularly important as the “AI economy” continues to roar and new models with advanced capabilities debut one after another. ChatGPT has shot from 500 million weekly active users just half a year ago to 700 million on the strength of new tools, and OpenAI very recently secured an additional $8.3 billion in funding.
