New Zealand’s public service has been told, in blunt terms, to stop being “scared of AI” and start using it. That directive just collided with an awkward reminder from across the Tasman and beyond: private conversations shared via Anthropic’s Claude chatbot appeared in Google search results, exposing everything from medical records to login credentials. In the AI era, “share” and “private” are proving to be very different words. For the public servants now expected to draft policy and summarise reports with AI assistants, for the accountants at small firms pasting client spreadsheets into a chatbot, and for the university researchers running grant applications through Claude, this is not a curiosity story about one chatbot’s bug. It is a governance problem. New Zealand’s Privacy Act 2020 puts clear obligations on any organisation handling personal information, and those obligations don’t evaporate the moment an employee clicks “share.” Where the safeguard broke down The root cause is a gap between what Claude’s sharing feature promises and what it technically enforces. Clicking “Share” on a Claude conversation generates a …