Claude deducts another point from the closed-source camp

The closed-source camp has suffered another setback, this time over an unignorable information security vulnerability.

In the early hours of Beijing Time on July 26, a Reddit user posted that searching site:claude.ai/share on Google would directly expose private chat records between other users and Claude, essentially granting full access to users' entire communication history.

One user found an encrypted cryptocurrency wallet with its private key exposed, verified the access, and confirmed it actually held a balance. Others uncovered documents including lawyer discussions on whether self-reporting is required for professional conduct violations, resumes, suspected social security numbers, clinical trial abstracts, and identifiable personal information of a big-tech employee.

By the morning of July 26, the search results on Google had disappeared, while they remained accessible on Bing and Brave. As of July 28, Anthropic had not issued a single public statement regarding this incident.

If this had happened in China, I can hardly imagine how the situation could be properly contained.

AI-generated image

How the Leak Occurred

The current technical explanation is: Anthropic failed to set the noindex tag on its shared pages.

A hands-on verification conducted by security analyst Daniel J Glover on July 26 revealed a more complex scenario. The shared pages carried the X-Robots-Tag: none response header, which is intended to mean "do not index", but this directive was overridden by a Disallow rule in the site's robots.txt file. This caused the tag to be bypassed, leaving the exposed information fully accessible on the public internet.

This is essentially a directive conflict between Anthropic and Google itself. Google's official documentation specifies that if a crawler is blocked from accessing a page, it will never be able to read the noindex tag on that page, which in turn caused the security rule to fail.

AI-generated image

The exact date when the noindex tag was supposed to be deployed cannot be traced now. Anthropic has long blocked Internet Archive from crawling its shared pages, so no historical snapshots are available. Later, a media outlet's spot check on July 28 found that the noindex tag was missing from the shared pages, and another media report stated that Anthropic only updated the configuration to add the tag after the incident broke out on July 26.

In summary, the entire incident is indeed complex, but the end result is extremely sloppy, creating an absurd situation where conflicting directives have no clear priority.

From the outcome perspective, the closed-source approach has suffered a major loss this time. This is the fourth similar incident within a year: one each from OpenAI and xAI, and two exclusively from Anthropic, all involving closed-source vendors. The root cause lies in the structural design: the sharing features of closed-source products are inevitably hosted on the vendor's servers, and this centralized pipeline gives the vendor absolute control — but it also makes them the sole target of public criticism once a failure occurs.

In contrast, open-weight models run on users' own local devices, eliminating this centralized pipeline and removing this entire exposure vector for leaks.

In this regard, the open-source approach has clearly taken the lead.

What Amodei Has Been Busy With This Past Week

During the same week the leak was unfolding, Anthropic CEO Dario Amodei was occupied with another matter.

The ongoing debate over the open-source vs. closed-source development path has reached a fever pitch. Jensen Huang created an X account, and his first tweet was a joint letter in support of open-weight models, signed by 25 companies. Within a few days, the signatory list doubled to 50 companies: OpenAI added its signature late on Friday, Google followed on Saturday, and Elon Musk reposted to express his stance.

Amodei blatantly pretended not to notice all this.

On July 27, Dario released an open letter on the company's official website, with a bolded opening line: "Anthropic has never advocated for a ban on open-weights models."

This statement is technically true: his public remarks over the past three years never explicitly called for a full ban. Back in 2023, he claimed that open-source was heading down a "very dangerous path", citing concerns that the internal workings of open models are opaque, community collaboration cannot function properly, and large models must be operated on cloud infrastructure.

The boomerang effect soon hit, as the community refuted this testimony point by point: open-weight models are released alongside their training scripts, tens of thousands of community fine-tuning efforts exist, and running Qwen 3 on consumer-grade GPUs has become a common practice.

Then Kimi K3 released its open weights, shocking Wall Street, and the entire world is on the verge of entering a massive open-source era.

The actual core content of Amodei's open letter advocates three key points: escalating the embargo on chips and manufacturing equipment against China, cracking down on industrial-level model distillation, and mandating pre-release safety testing for all sufficiently powerful models, regardless of whether they are open or closed. The first two points have clear targets, while the third leaves all critical details undefined: no specifications are provided for where the line of "sufficiently powerful" is drawn, who will conduct the testing, and what consequences will follow if a model fails the test.

Yet the company with the most frequent safety failures is Anthropic itself.

Looking at their long-standing data practices: Anthropic claimed to have added Reddit to its crawler blacklist as early as May, but platform audit logs show its bots continued to access the site more than 100,000 times afterward. A judge ruled that Anthropic knowingly downloaded at least 7 million pirated books, and the $1.5 billion settlement was just approved by the judge in the same week the conversation leak occurred. Decrypt also documented two more incidents: the company began requiring some users to submit government-issued IDs in April this year, and researchers discovered in July that Anthropic had quietly removed hidden tracking code from Claude Code.

Anthropic's research output on model alignment is indeed denser than its peers, and Claude has earned a solid reputation for its performance in coding workflows. The problem is that "safety" is increasingly becoming an externally marketed label for the company: it is pitched to Congress to gain regulatory influence, to enterprise clients to secure orders, and to the general public to justify its $900 billion valuation premium. When it comes to foundational engineering work that does not need to be advertised to anyone, a mistake that even an entry-level SEO intern would not make remained undetected on the company's website for 12 full months.

So who exactly gets to define what "safety" means?

The Landscape Has Shifted

Do you still remember the recent Hugging Face hacking incident?

Jensen Huang posted another tweet yesterday, which received 31,000 likes and was reposted by LeCun: during that security breach, leading closed-source models refused to assist in forensic investigation, and finally an open-weight model helped contain the intrusion.

The member wall of NVIDIA's newly announced Open Secure AI Alliance (screenshot from X page, captured on July 28, 2026)

A week ago, this was nothing more than verbal sparring over development paths. But today, the situation is completely different: closed-source models refuse to help at critical moments, and closed-source companies cannot even safeguard users' daily conversation records. From now on, whenever someone claims "closed-source is more secure", the audience's first reaction will be to recall the Claude incident.

Regardless of the endless bickering between open-source and closed-source proponents, the troubles faced by users and companies are very real. Shared links display the sharer's name, and the leaked conversations contain contracts, code, medical records, and sensitive client information.

From now on, all enterprises purchasing closed-source models on a per-seat basis will face a mandatory critical question: can sharing features be centrally disabled, can shared links be revoked, and can crawlers actually read the anti-indexing measures implemented on the platform. Anthropic's sales teams will have to answer these three questions in person for every client going forward, and OpenAI's sales teams may face the same requirement.

Anthropic itself has experienced four consecutive major setbacks in seven days: the $1.5 billion settlement was approved, a payment vulnerability caused a global service outage, the conversation leak occurred, and the company absented itself from the joint letter before releasing a self-defense statement that no one buys into. From now on, the cost of using the slogan "the safest AI company" will no longer be the same as before.