Hidden Ways AI Chats Leak or Get Used for Training

Last week, in Stop Putting Client Information Into Your Paid ChatGPT or Claude Account, we looked at why confidential client information does not belong in personal ChatGPT or Claude accounts, free or paid. A paid personal plan runs on the same consumer terms as a free one, and moving to a business plan with a data processing agreement is the place to start.

This week picks up from there. Moving to a business plan changes the contract: your content is no longer used for training by default, a data processing agreement comes into effect, and the vendor's commercial terms treat your content as your confidential information. "By default" matters. As covered below, a single click on a feedback button can still send a full conversation for training on one vendor's business plans.

The contract only covers what happens inside the vendor's systems. Some of the most common ways client information ends up somewhere it shouldn't come from features: a feedback button, a share link, a published page, a connected app. Several of these are switched on by default, including on business plans.

This article walks through each one, what has actually happened, and the settings worth checking.

Rating a response looks harmless. On one of the two vendors' business plans, it sends the whole conversation for training.

• Claude Team and Enterprise. Clicking thumbs up or down stores the entire related conversation, including any content, for up to 5 years, and Anthropic may use it to train its models. Anthropic removes user and customer IDs first, but the content itself is included. Admins can turn this off for the organization with the "Rate chats" setting under Organization settings > Data and Privacy (Anthropic (opens in a new tab)).
• ChatGPT Business and Enterprise. Rating a response does not permit training on the conversation. Admins can still turn response feedback off under Workspace settings > Allow response feedback (OpenAI (opens in a new tab)).

On both vendors' personal plans, a rating can send the conversation for training even if training is switched off in settings.

Both ChatGPT and Claude let you share a conversation with a link. On personal plans, anyone who has that link can open it. Three times in the past year and a half, those links became searchable.

• ChatGPT, July 2025. A "make this chat discoverable" checkbox let shared chats be indexed by search engines, and thousands turned up in Google, some containing names, resumes, and confidential work content. OpenAI removed the option on July 31, 2025 and worked with search engines to remove the indexed pages (TechCrunch (opens in a new tab)).
• Claude, September 2025. Google estimated it had indexed just under 600 shared Claude conversations before they disappeared from its results (Forbes (opens in a new tab)).
• Claude, July 2026. Shared Claude conversations and published Artifacts (apps, documents, and dashboards made in Claude) showed up in Google search results again. Some reportedly included medical information, company documents, and children's names and phone numbers (TechCrunch (opens in a new tab), Fortune (opens in a new tab)). Anthropic had blocked search engines from crawling the pages, but Google's own documentation explains that a page blocked from crawling can still be indexed if it is linked from other sites; keeping it out of results takes a "noindex" instruction or password protection (Google Search Central (opens in a new tab)).

Anthropic now adds a noindex instruction to every shared page, while noting that it cannot guarantee every crawler on the internet honors it (Anthropic (opens in a new tab)). A share link on a personal plan is best treated as a public page.

On business plans, both vendors now keep shared chats inside the organization:

• ChatGPT Business and Enterprise. A link created in a workspace can be opened only by members of that same workspace. Anyone outside it gets an access error (OpenAI (opens in a new tab)).
• Claude Team and Enterprise. Members cannot create public links at all. Shared chats are visible only to signed-in members of the same organization (Anthropic (opens in a new tab)).

There is one gap. ChatGPT Enterprise admins can switch off sharing for the whole workspace. ChatGPT Business admins cannot: members can delete links they made, but there is no workspace-wide off switch (OpenAI (opens in a new tab)). A link shared inside the workspace is still visible to every colleague who receives it, including people who should not see that client's file.

Shared chats are locked down. Some newer features that publish content are handled differently.

• ChatGPT Sites. Sites lets members build and host web pages from ChatGPT. It is on by default in ChatGPT Business workspaces, and a Site can be shared with anyone on the internet if public publishing is enabled and the member has permission to publish (OpenAI (opens in a new tab)). A page built from client material can leave the workspace this way.
• Custom GPTs. A GPT can be set so that anyone with the link can use it, where public link sharing is available (OpenAI (opens in a new tab)). A GPT loaded with client documents as its knowledge base is exposed at whatever level its builder chooses.
• Claude Artifacts. On Team and Enterprise plans, artifacts stay inside the organization by default. Two settings open them up. If an owner turns on External sharing, members can share an artifact with "Anyone with the link," which lets anyone signed in to any Claude account open it, and a Claude account is free to create. Separately, Email invitations outside your organization lets members invite specific outside people by email; it is on by default on Team plans and off by default on Enterprise. One more detail is easy to miss: when an artifact made in a chat is shared, viewers also get access to the attachments and files in that chat (Anthropic (opens in a new tab)).

Both vendors let you connect the AI to Google Drive, email, calendars, SharePoint, and other tools. Each connection widens where client data flows.

Two things are worth knowing. First, defaults differ by plan. In ChatGPT Enterprise, the new Google Drive actions stay off until an admin enables them; in ChatGPT Business, they are on by default (OpenAI (opens in a new tab)). Second, the agreement you signed may not be the only terms that apply. OpenAI notes that when an admin enables optional or additional services in a managed account, those services may be governed by their own service-specific terms and privacy policies (OpenAI (opens in a new tab)). A connected third-party app also handles the data under its own provider's terms.

A connector also gives the AI access to everything the connected account can see. An assistant connected to a shared drive can pull another client's file into a conversation without anyone uploading it.

A business plan changes who controls the data. It also adds people who can see it.

• Workspace admins. On ChatGPT's managed accounts, including Business and Enterprise, OpenAI says your administrator may be able to access, export, audit, retain, and delete the data tied to the account, including prompts, uploaded files, outputs, and conversation history. The administrator can also opt in to share that data with OpenAI to improve its models (OpenAI (opens in a new tab)). Client information one team enters is visible to whoever administers the workspace, and whether it is used for training is ultimately the admin's choice.
• Vendor safety reviewers. Both vendors run automated safety systems over business conversations, and flagged content can be reviewed by people. Anthropic keeps flagged conversations for up to 2 years, on commercial plans too (Anthropic (opens in a new tab)).
• Your employer, through a personal account. A personal ChatGPT or Claude account opened with a work email address can be moved into, or linked to, the organization's business workspace later, where its admins can see its contents (OpenAI Terms of Use (opens in a new tab), Anthropic Consumer Terms (opens in a new tab)). The reverse risk matters too: client work done in a personal account opened with a work email sits outside every business-plan protection until that happens.

Every protection in this article depends on decisions the vendor makes, and the vendor can change them. The past year shows how often that happens:

• Defaults flipped. Anthropic switched its consumer plans to training on chats by default in late 2025, with up to five years of retention for those who allow it (Anthropic (opens in a new tab)).
• Retention promises narrowed. In 2026, Anthropic began keeping prompts and outputs for 30 days on its newest models, including for customers who had zero data retention agreements (Anthropic (opens in a new tab)).
• Features shipped and pulled. ChatGPT added a "make discoverable" option for shared chats, then removed it after shared conversations appeared in Google. Claude's shared pages went out without a noindex tag and had to be fixed after the fact.
• New features arrive switched on. ChatGPT Sites and the new Google Drive actions are on by default in ChatGPT Business, and outside email invitations for Claude Artifacts are on by default on Team plans.
• Courts override deletion. A preservation order in the New York Times lawsuit required OpenAI to keep chats that users and business-plan customers had deleted.

None of these required the customer's agreement. Business plans run on standard online terms the vendor can update, and new features come with the vendor's chosen defaults. An admin who locked everything down in January may have new settings to review by June. The controls a business keeps for itself are its own policies and what it chooses to send in the first place.

Claude Team and Enterprise

• Turn off Rate chats under Organization settings > Data and Privacy, so feedback cannot send client conversations for training.
• Under Organization settings > Artifacts, keep External sharing off, and turn off Email invitations outside your organization, which is on by default on Team plans. Before sharing an artifact made in a chat, remember its viewers can also see that chat's attachments.
• Review which connectors are enabled and who can add new ones.

ChatGPT Business and Enterprise

• Decide whether Sites should be available, and keep public publishing off unless there is a reason for it.
• Restrict custom GPT sharing to the workspace.
• Review app and connector defaults, especially Google Drive on Business, where it starts switched on.
• On Enterprise, turn off link sharing workspace-wide if your work does not need it. On Business, ask members to review and delete old links under Settings > Data controls > Shared links.
• Turn off response feedback under Workspace settings > Allow response feedback if you prefer no ratings at all.

Everyone

• Delete any shared links created from personal accounts, and treat any link that ever existed as potentially public.
• Close or migrate personal accounts opened with work email addresses.
• Keep highly sensitive information out of AI tools in identifiable form. A local de-identification tool such as Conseal replaces client details with consistent placeholders on your own computer before anything is uploaded, and restores them after the AI responds.

A business plan governs what the vendor does with your data. Most accidental exposure comes from what people do with the features: sharing a link, publishing a page, connecting a drive, clicking a rating. Keeping those under control is ongoing work, because vendors keep adding features and changing defaults.

The ones that remain depend on people getting it right every time, and on vendor settings that can change. De-identifying documents before they are uploaded is a control that stays with you either way. If a share link leaks, a default flips, or a court orders chats preserved, what's exposed is placeholders instead of your client's names, account numbers, and case details.