Anthropic retired the artifacts gallery. Its sitemaps are still feeding Google.

That published Claude artifacts turn up in Google search results is not news. I saw it on Reddit first, and I genuinely don’t know who noticed it earliest — the posts I read didn’t cite a source and I couldn’t trace one. So: not my finding, and I’m not going to pretend otherwise. The reaction was reasonable and the observation was correct.

What nobody explained is why they’re there at all.

Not “why does Google index public pages” — that part is obvious. Why is Anthropic submitting them? A sitemap is not passive. It’s a file whose entire purpose is to walk up to a search engine and hand over a list of URLs you would like crawled. Somebody built that file. It contains exactly ten thousand user documents.

I went looking for who built it and why, and then I probed all ten thousand to see what was in there. This post is the first half — where the sitemaps came from and how an artifact ends up in front of a crawler. A second post, on what that has cost, follows shortly.

One thing this is not about, before anything else. This is Publish, not Share. robots.txt disallows /chat/* and /share/* — shared conversations are deliberately withheld from crawlers, and that is the correct call. Nothing here says your shared chats are in Google. They aren’t.

The answer is a feature that doesn’t exist any more

In May 2025, TestingCatalog reported an unreleased Anthropic feature: an Artifacts Gallery. A browsable, curated set of user-made artifacts, organised into categories — Learn something, Life hacks, Play a game, Be creative, Touch grass.

Those five names map one-for-one onto the sitemap filenames. Two more, code-tech and data-analysis, look like later additions.

The dates line up cleanly:

So the sitemaps are exactly what they look like. Somebody was building a discovery product, a discovery product needs things to rank, and ten thousand curated artifacts got submitted to Google so the gallery would have a catalogue.

That’s an ordinary thing to build. I want to be clear about it because the rest of this is not a conspiracy story.

The gallery is gone. I checked signed out and signed in — the catalog path and its category pages return the app’s own “Page not found,” and no catalog API responds. Google still holds a cached catalog landing page titled “Thai Artifacts Built with Claude,” which is how I found the thing in the first place.

The surface was switched off. The plumbing was not. There is now nowhere on claude.ai to browse published artifacts, which means external search is the only way one gets discovered — and the file feeding that search is still being served, twelve months after the feature it was built for stopped existing.

That’s the whole mechanism. Not malice, not even negligence exactly. Just the ordinary way infrastructure outlives intent, running unattended in a place where the output is other people’s documents.

What got swept in

Every one of the 10,000 probed on 26 July 2026. Not a sample.

Views run: minimum 16, median 83, ninetieth percentile 284, maximum 297,282.

That minimum is the tell. No artifact in the sitemap has fewer than 16 views, while artifacts I found outside it sit at 1, 3, 8, 10. Daily entry counts decay toward the cutoff date while median views stay flat at about 80 across all twenty-six days — the signature of a fixed engagement threshold that newer artifacts hadn’t had time to clear.

So the selection criterion was popularity. Not sensitivity, not content type, not whether the document had anyone’s name in it. It was built to find things worth showing off, and it ran across whatever people had published.

Which also means this corpus is a shortlist. It under-represents the quiet personal one-off nobody looked at, so every proportion I report anywhere is a floor.

How an artifact reaches a crawler

The sitemap is one of two systems, and they don’t talk to each other.

The sitemap hands Google a list of URLs. Separately, every published artifact carries a robots directive that tells Google whether it may keep the page — and that directive defaults to index, follow.

There’s a detail here I had wrong at first and it matters. Fetch an artifact page over plain HTTP and it comes back noindex, nofollow — identically to a UUID that never existed. That looks reassuring and it isn’t. The real directive is written into the DOM by client-side script, pulled from a per-artifact API field. Googlebot renders JavaScript. Googlebot sees index, follow.

Sitemap membership isn’t what makes an artifact indexable either. Of fourteen indexed artifacts I found outside the sitemap, eleven are index, follow — and one carries a timeline running to March 2026, eight months after the sitemap froze. The file stopped updating. The default did not.

The one piece of genuinely good engineering here deserves saying plainly: artifacts render in an iframe from a separate registrable domain, sandboxed. Artifact JavaScript cannot reach your claude.ai cookies or storage. The naive fear — a published artifact stealing your session — is the thing the architecture is built against, and it works.

Nobody was told

I inventoried the full claude.ai web bundle — all 233 JavaScript chunks, including the 189 that load lazily — looking for whatever the publish flow tells you about any of this.

It tells you nothing. The artifact publish flow carries no descriptive copy at all: two error toasts, the notice that unpublishing is permanent, and a button label. Within four thousand characters either side of all seven publish-API call sites there is no readable text. Absent from the entire bundle: “indexed by”, “anyone on the internet”, “Publicly”, “Publish to”, “Make public”, “Share publicly”. The single instance of “search engine” is an onboarding survey option sitting next to “Friend or family.”

Now compare Claude Code session sharing, in the same bundle. That flow has a full visibility ladder — Only you have access / Everyone in your org / Anyone with repo access and the link / Anyone with the link. And beside it, these strings:

“This session is from a private repository and may include secure credentials. Anyone with the link…”

“This session is from a private repository. Sharing may expose code to anyone with the link.”

Someone wrote those. Someone sat down, thought about what could go wrong when you share a session from a private repo, and wrote the warning.

So the argument isn’t that the publish wording is incomplete. It’s that there is no wording at all, in a company that demonstrably knows how to write it, for the flow whose output was submitted to Google in eleven topical sitemaps.

What I got wrong

Worth listing, because the failure mode is the point of the whole exercise.

I assumed enumeration was impossible before reading robots.txt, which declares the sitemap index in its first few lines. I described the publish flow’s warnings from memory when the actual copy was sitting in a JavaScript file anyone can fetch. I claimed every artifact page offers to pull its source into your session — the Remix button had already been removed, and the docs say so. I put the artifact iframe on the wrong domain, which made the isolation sound weaker than it is.

Every one of those came from inferring instead of looking. The gallery was one search away the entire time.

The lesson

A cancelled feature can keep running.

The gallery had a UI, a category taxonomy, and an SEO strategy. Someone switched off the UI. The taxonomy is still sitting in robots.txt and the SEO strategy is still handing ten thousand user documents to Google, a year after the surface it was built for stopped existing.

Retirement checklists cover the things users can see. This is what’s underneath — and the reason it matters is what’s inside those ten thousand documents. That’s the second post, and it’s the one with the people in it.

SOs

SOs — standing orders you can lift and prime your own agent with. (New here? The convention started with the Neverland post.) Paste them into a session for a one-time dose, or commit them to your CLAUDE.md / AGENTS.md and they stay in force.

``` STANDING ORDERS — Publishing, indexing, and retirement Source: “Anthropic retired the artifacts gallery” — bensimon.dev

1. Before anything is published, shared, or made “public,” state what that specific control does: who can reach it, whether it is submitted to search engines, and whether the action can be undone. If the product does not document it, say so rather than assuming the safe reading.

2. Assume search indexing is ON by default for anything published, unless you have checked the actual directive for that specific item. An unguessable URL is not a privacy control once it has been handed to a crawler.

3. Check the rendered directive, not the raw HTML. A page can serve noindex over plain HTTP and inject index, follow client-side. Crawlers that execute JavaScript see the injected value.

4. When retiring a feature, enumerate what it emits, not just what it displays: sitemaps, feeds, webhooks, scheduled jobs, cached endpoints. Ask explicitly what keeps running after the UI is switched off.

5. When asked how a platform behaves, fetch robots.txt, the API response, or the shipped JavaScript before answering. Prefer “I looked, and here is what it says” over confident recollection — and flag it explicitly when you have not looked.

6. Treat an irreversible action as a design constraint, not a footnote. If unpublishing is permanent, say so before the publish, not after. ```