Grok chatbot leaks 370,000 user conversations via search engine indexing
A Forbes investigation discovered that over 370,000 user conversations with xAI's Grok chatbot were indexed by search engines after users clicked a share button, exposing personal data and sensitive requests because the system failed to warn that links would be automatically indexed. The leaked conversations reportedly included instructions for illegal drugs and bombs, along with plans to harm individuals, contrary to xAI's own content policies.
What happened
A search of Google revealed more than 370,000 conversations with Grok indexed by search engines, according to Forbes investigation reported on 20 August 2025.
When users clicked Grok's share button to generate a link for sharing conversations via email or messaging apps, the system did not warn them that these links were also being indexed by search engines including Google, Bing, and DuckDuckGo, making conversations visible to anyone searching for them.
Reported impact
The indexed conversations included personal data and sensitive requests across medicine and psychology, as well as shared image files, spreadsheets and documents.
Some conversations contained concerning content that violated xAI's own rules, including suggestions for creating drugs, malware, and bombs, as well as methods for suicide and a detailed plan to assassinate Elon Musk.
Index analysis
Unlike the similar ChatGPT incident where share functionality required user consent to make conversations visible to search engines, Grok's share feature did not inform users that conversations would be automatically published on the Grok website and indexed by search engines.
Security experts and AI researchers, including Nathan Lambert, were affected by the lack of warning about indexation, raising concerns about data privacy and security on AI platforms.
Governance controls
As of the reporting date, xAI had not publicly responded to the incident.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.