Brandon Klayme served 18 months in a Canadian prison because a police subpoena contained a single missing underscore. Not a missing suspect. Not a misidentified face. One character in a username.
The case started in Wisconsin in 2018, when a 12-year-old girl was found to have been exchanging messages on the Kik messaging app with an adult male. The username in question was "fus__ro_dah" — a nod to the dragon shout from the video game Skyrim, two underscores included. When Dane County investigators sent a subpoena to Kik requesting account information, they accidentally typed "fus_ro_dah" — one underscore. Kik dutifully returned records for that account, which happened to belong to Klayme, a Nova Scotia man with no connection to the case whatsoever.
From there, the digital breadcrumbs pointed squarely at the wrong guy. The email on Klayme's Kik account was linked to an IP address in Canada, which led investigators to Halifax Regional Police, who traced the IP to Klayme's home address through his internet provider. A search warrant followed. Phones and laptops were seized from his bedroom.
Here is where it gets genuinely maddening: the devices contained nothing. No images. No messages connected to the Wisconsin girl. Investigators could not even establish that Klayme had used Kik during the relevant period. The evidence against him was, by any reasonable standard, nonexistent.
And yet, Klayme was arrested in 2020, charged with child sex abuse offences, convicted at trial in 2023, and sentenced in 2024. He served every day of his 18-month term before the Nova Scotia Court of Appeal overturned the conviction this past week, writing plainly that Klayme "is factually innocent of the offences" and "should never have been charged, let alone convicted."
The username discrepancy was only discovered while Klayme's legal team was preparing his appeal. Which means the error sat undetected through the original investigation, the arrest, the trial, the sentencing, and the entirety of his incarceration. Multiple law enforcement agencies, prosecutors, and a court all processed this case without anyone pausing to verify that the username in the subpoena actually matched the username in the forensic report.
This is the part that should make people deeply uncomfortable. The failure here was not exotic. It was not a sophisticated technical flaw or an obscure edge case in database architecture. It was a typo — the kind that a basic quality-control check, or even a side-by-side comparison of two strings of text, would have caught immediately.
The broader implication is hard to ignore. Law enforcement increasingly relies on digital identifiers — usernames, IP addresses, account metadata — to build cases. That reliance is only growing as more crime moves online. But those identifiers are only as reliable as the humans transcribing them, and apparently nobody built in a step to double-check the transcription.
Klayme got his conviction overturned. The actual perpetrator, the person behind "fus__ro_dah," remains unidentified. The investigation that was supposed to protect a 12-year-old girl ultimately failed her too.
SECURITY
Private Claude AI Chats Were Publicly Indexed by Google and Bing
People were asking Anthropic's Claude about which political party to join, legal ethics questions, and erotic roleplay. Then those conversations showed up in Google and Bing search results, visible to anyone who knew where to look.
The exposure, flagged over the weekend by a Reddit user, stems from a gap between how Anthropic told search engines to behave and what search engines actually require to comply. It is a surprisingly mundane technical failure for something with genuinely uncomfortable consequences.
Here is how Claude's sharing feature works: users can generate a public URL for any conversation, essentially creating a shareable snapshot of a chat thread. Anthropic does not want these shared links crawled and indexed by search engines, and the company has used a robots.txt file to communicate that preference since at least September 2025. Robots.txt is the long-standing web standard for telling crawlers which parts of a site to leave alone. Anthropic followed the convention. The problem is that convention is not enforcement.
Both Google and Bing have documented, in their own developer guides, that robots.txt alone is not sufficient to prevent a page from being indexed. If a page gets linked to from somewhere else on the internet, Google may index it regardless of what robots.txt says — unless the page also includes a "noindex" tag in its HTML or a corresponding tag in the page's response header. Bing makes a similar recommendation. Anthropic's shared chat pages had neither.
The result: Bing was still returning hundreds of results for shared Claude conversations at the time of reporting. Google appeared to have cleaned up its results faster, but the chats had already been sitting in search indexes long enough to be discovered and shared publicly.
Google, for its part, was quick to clarify where the responsibility lies. A spokesperson told WIRED that indexing decisions for shared Claude pages are Anthropic's to manage, noting that Google provides site owners with the tools to control crawling and indexing. That is technically accurate. It is also a little convenient, given that Google's crawler is the one doing the indexing.
Anthropics did not respond to requests for comment. Microsoft, which owns Bing, also declined.
The deeper issue here is one of expectation versus reality. When a user clicks a button to share a chat, they are almost certainly not thinking about robots.txt files or noindex tags. They are sharing with a friend, a colleague, or maybe a specific audience. The idea that the conversation might end up discoverable by a stranger running a search engine query is not something most people would anticipate, or consent to.
This is not a catastrophic breach, and it is fixable — Anthropic simply needs to add the appropriate tags to shared chat pages. But it is a useful reminder that AI platforms are still websites, subject to all the same mundane infrastructure decisions that have tripped up web developers for decades. The newness of the technology does not exempt it from the boring fundamentals of how the internet actually works.
Source: WIRED
The exposure, flagged over the weekend by a Reddit user, stems from a gap between how Anthropic told search engines to behave and what search engines actually require to comply. It is a surprisingly mundane technical failure for something with genuinely uncomfortable consequences.
Here is how Claude's sharing feature works: users can generate a public URL for any conversation, essentially creating a shareable snapshot of a chat thread. Anthropic does not want these shared links crawled and indexed by search engines, and the company has used a robots.txt file to communicate that preference since at least September 2025. Robots.txt is the long-standing web standard for telling crawlers which parts of a site to leave alone. Anthropic followed the convention. The problem is that convention is not enforcement.
Both Google and Bing have documented, in their own developer guides, that robots.txt alone is not sufficient to prevent a page from being indexed. If a page gets linked to from somewhere else on the internet, Google may index it regardless of what robots.txt says — unless the page also includes a "noindex" tag in its HTML or a corresponding tag in the page's response header. Bing makes a similar recommendation. Anthropic's shared chat pages had neither.
The result: Bing was still returning hundreds of results for shared Claude conversations at the time of reporting. Google appeared to have cleaned up its results faster, but the chats had already been sitting in search indexes long enough to be discovered and shared publicly.
Google, for its part, was quick to clarify where the responsibility lies. A spokesperson told WIRED that indexing decisions for shared Claude pages are Anthropic's to manage, noting that Google provides site owners with the tools to control crawling and indexing. That is technically accurate. It is also a little convenient, given that Google's crawler is the one doing the indexing.
Anthropics did not respond to requests for comment. Microsoft, which owns Bing, also declined.
The deeper issue here is one of expectation versus reality. When a user clicks a button to share a chat, they are almost certainly not thinking about robots.txt files or noindex tags. They are sharing with a friend, a colleague, or maybe a specific audience. The idea that the conversation might end up discoverable by a stranger running a search engine query is not something most people would anticipate, or consent to.
This is not a catastrophic breach, and it is fixable — Anthropic simply needs to add the appropriate tags to shared chat pages. But it is a useful reminder that AI platforms are still websites, subject to all the same mundane infrastructure decisions that have tripped up web developers for decades. The newness of the technology does not exempt it from the boring fundamentals of how the internet actually works.
Enjoyed this?
Get stories like this delivered every Tuesday — free.