Anthropic旗下AI助手Claude在7月26日凌晨爆出严重信息泄露事件[1]。Reddit用户发现可通过Google搜索"site:claude.ai/share"直接访问他人与Claude的私聊记录[1]，泄露数据包括加密货币钱包私钥、律师讨论、社保号、临床试验摘要和大厂员工信息等敏感内容[1]。技术根源在于分享页面的安全标签配置失效——虽然返回头包含X-Robots-Tag: none指令，但被robots.txt中的Disallow规则挡住，导致安全标签失效[1]。
事件发生后的应对引发关注[1]。7月26日上午Google搜索结果消失，但Bing和Brave搜索引擎上的泄露数据仍然存在[1]，而Anthropic直至7月28日未发布任何公开声明[1]。这是闭源AI厂商一年内第四次同类安全事件，其中OpenAI和xAI各发生一次，Anthropic独占其中两次[1]。
这一风波发生之际，Anthropic CEO Dario Amodei在7月27日发公开信表示"Anthropic has never advocated for a ban on open-weights models"[1]，但此言引发社区反驳，被指与公司三年来的公开表态不符[1]。同期黄仁勋发起支持开源权重模型的联名信，初期25家公司签署，数日内增至50家，随后OpenAI和谷歌也加入其中[1]。
此外，Anthropic在数据合规上存在历史问题[1]。公司自称从5月起将Reddit列入爬虫黑名单，但审计日志显示其机器人仍访问超十万次[1]；公司还因明知下载至少700万册盗版图书被法官认定，15亿美元和解金在此次泄露事件发生当周获批[1]。
Anthropic's AI assistant Claude experienced a significant security incident on July 26 when users discovered that private conversations and sensitive personal information could be accessed via Google search queries targeting the platform's share pages [1]. The breach allowed public access to data including cryptocurrency wallet private keys, legal discussions, Social Security numbers, clinical trial summaries, and employee information from major technology companies [1].
The vulnerability stemmed from a configuration error in the sharing page headers, where an X-Robots-Tag: none directive was rendered ineffective by an overly broad Disallow rule in the robots.txt file, preventing the security tag from functioning properly [1]. While the search results disappeared from Google by the morning of July 26, the indexed content remained accessible through Bing and Brave search engines as of July 28, with Anthropic declining to issue a public statement about the incident [1].
This marks the fourth such data exposure incident among closed-source AI companies within a year, with OpenAI and xAI each experiencing one previous incident and Anthropic accounting for two [1]. The timing coincided with CEO Dario Amodei's public statement asserting that "Anthropic has never advocated for a ban on open-weights models," a claim that community members contested as inconsistent with the company's documented positions over the previous three years [1]. Simultaneously, NVIDIA CEO Jensen Huang launched an open letter supporting open-source model weights, which initially garnered signatures from 25 companies before doubling to 50 within days, with OpenAI and Google subsequently adding their support [1].
The incident also highlighted Anthropic's broader compliance challenges: the company had claimed to add Reddit to its crawler blacklist in May, yet audit logs revealed bot access exceeded 100,000 times afterward [1]. Additionally, a federal judge had previously determined that Anthropic knowingly downloaded at least 7 million pirated books, with the resulting $1.5 billion settlement being approved during the same week as this latest breach [1].
