To share a Claude Artifact without exposing private context, keep it private until you have frozen the exact version, inspected its content and behavior, and mapped its conversation, file, Project, connector, and storage dependencies. A new artifact stays private until you choose an audience in Share, while a published legacy link opens without a Claude account. Test the link as a recipient and test unsharing before relying on it.

The responsible AI framework provides the wider principle: generated output becomes shareable only after a human verifies both its claims and its exposure boundary.

Key Takeaways

Confirm the correct artifact version; in Claude Code each publish becomes a version, and the Share control sets which one viewers see.［5］

New artifacts start private. A legacy chat artifact published on Free, Pro, or Max is publicly available by link, while Team and Enterprise sharing stays inside the organization unless an owner allows external links.［2］

When an artifact made in a chat is shared on Team or Enterprise, viewers also get access to attachments and files in that chat.［2］

Project access, connected apps, calls to Claude, and personal or shared storage need separate review.［1］［3］

Stopping sharing closes the original route but cannot retrieve copies; unpublishing a legacy artifact permanently deletes its storage data.［1］［2］

Treat code copied from another Artifact as untrusted input and review it before running.［2］

What counts as private context around an Artifact?

An Artifact may look self-contained while depending on more than the visible panel. Private context can include the prompt that defined it, earlier revisions, uploaded documents, Project knowledge, names in test data, comments in source code, hidden endpoints, browser storage, connector outputs, or information saved by an interactive app.

Anthropic describes artifacts as self-contained work such as documents, decks, designs, code, dashboards, and small interactive tools. Depending on plan and settings, they can call Claude, read from and write to connected apps, and store personal or shared data between sessions.［1］ A visual preview cannot prove that those dependencies are safe.

Build an exposure map:

Surface	Questions before sharing
Visible output	Are names, records, comments, metadata, or unsupported claims present?
Source code	Are secrets, internal URLs, analytics IDs, or unsafe dependencies embedded?
Creating conversation	Does sharing include messages, attachments, or files?
Project	Must a recipient already have Project access, and what else does that reveal?
MCP/network	Which external services can the Artifact contact or ask each viewer to authenticate?
Persistent storage	Is data personal or shared, and what happens on unpublish?
Copies and embeds	Can viewers copy code or embed the public result elsewhere?

For building and revising the output itself, follow the separate Claude Artifact prototype workflow. This guide begins when a version is ready for access review.

How do you share a Claude Artifact versus publish it?

Anthropic now separates current artifacts from legacy ones made in a chat before 16 September 2026. A current artifact uses one Share menu: “Only you” or “Anyone with the link” on Pro and Max, plus invite-only and organization options on Team and Enterprise, with Can view, Commenter, or Can edit access. Viewers need a Claude account, and artifacts that use Claude or connected apps cannot use link sharing.［2］ The exception is a legacy artifact published on Free, Pro, or Max: anyone with the link can view and use it without an account, and signed-in users can copy it.［2］

Action	Audience	Review assumption
Share a current artifact	Invited people, the organization, or signed-in link holders	Choose the narrowest audience and access level
Publish a legacy chat artifact	Public link, no account needed	Treat every visible field and behavior as internet-public
Share a legacy artifact on Team/Enterprise	Organization members; external link only if an owner allows it	Inspect conversation attachments and Project access
Embed a published legacy artifact	Visitors on allowed embedding domains	Review hosting page, allowed domains, and copied embeds
Share the entire chat	Recipients of a conversation snapshot	Review all messages before the snapshot, including Artifacts
Publish from Claude Code	Private until shared; public links need no sign-in［5］	Check which version the link serves

Do not infer privacy from an unguessable URL. A public link can be forwarded, indexed by another system, captured in logs, or embedded by an authorized site. An organization link narrows the audience but may still expose information to far more people than the original conversation.

What happens when you update a shared artifact?

Updating does not reset access. Claude Code republishes edits to the same URL, anyone with the page open sees the change, and each publish becomes a version; the Share control decides which version viewers get.［5］ A later revision can therefore reach an audience you approved for an earlier one, so repeat the review before every publish that people can see.

Interactive artifacts add one more prompt: the first time someone uses shared storage, Claude explains that their data will be visible to others.［1］

Step 1: Freeze the exact version and sharing purpose

Write down the Artifact identifier, version or revision cue, owner, intended recipients, approved purpose, and expiry.

Compare the selected version with its neighbors: a later revision may reintroduce test data, debug output, comments, or a connector the approved version did not contain.

Use a release note:

Artifact: onboarding-checklist-demo
Approved version: review-2026-09-04-02
Audience: named product-review group
Purpose: interaction and accessibility review
Excluded: customer examples, internal API, analytics, persistent storage
Expires: end of review window
Owner: product operations role

If you cannot uniquely identify the intended revision, stop and create a clean replacement from approved inputs rather than guessing.

Step 2: Audit visible content and code

Read every rendered screen, empty state, error message, tooltip, sample record, downloadable file, and responsive view. Search the source for secrets, internal hostnames, email addresses, customer identifiers, comments, environment assumptions, network requests, local/shared storage, and external packages.

Use synthetic data that cannot be confused with a real person or production record, and verify that hidden JSON and browser state do not retain the original.

For code Artifacts, run the AI-generated code review checklist before execution or publication. Check dependency identity, permissions, network egress, input bounds, output encoding, unsafe HTML, prompt injection, and destructive actions. A polished preview is not a security review.

Separate factual approval from visual approval:

Factual: claims, numbers, names, citations, and legal statements are supported.
Functional: buttons, forms, storage, links, and error paths behave as stated.
Privacy: the output contains only approved data and sends data only to approved destinations.
Accessibility: keyboard use, labels, contrast, motion, and error feedback have been tested.
Rights: code, images, text, fonts, and source material may be shared with this audience.

Step 3: Audit the creating conversation, files, and Project

This step changes depending on the sharing route. Anthropic warns that when an artifact made in a chat is shared on Team or Enterprise, viewers also get access to attachments and files in that chat.［2］ Therefore, inspect the entire creating conversation and its files before sharing; do not review only the Artifact panel.

If the Artifact was created in a Project, confirm whether recipients must receive Project access. Anthropic says private Project members can see Project content, knowledge, and instructions according to their role, while chats remain private unless separately shared.［3］ Do not broaden Project membership merely to make one Artifact link work if a clean standalone version would suffice.

Chat sharing is another distinct route. Anthropic describes a shared chat as a snapshot of messages sent before sharing, including Artifacts; later messages stay private unless the snapshot is updated, and attached files and raw MCP tool data stay out of it.［4］ Do not generalize these chat rules to Artifact sharing.

Step 4: Remove private dependencies instead of hiding them

The safest shareable Artifact is rebuilt from the minimum approved context. Hiding a panel, collapsing code, or deleting a visible label does not remove a secret embedded in source, network requests, attachments, or storage.

Use this reduction sequence:

Create a clean conversation or approved Project containing only necessary inputs.
Replace real records with reviewed synthetic examples.
Remove unused attachments, connectors, environment variables, URLs, and packages.
Strip comments, metadata, debug logs, prompt fragments, and internal decision notes.
Disable persistent storage unless the feature truly requires it and the data model has been reviewed.
Disable network access or narrow destinations where account controls allow it.
Rebuild and compare the clean version against the approved behavior checklist.

Copying visible output into a new clean Artifact can be safer than trying to sanitize a long mixed-purpose conversation. Preserve provenance and rights, but do not copy the private prompt history.

Step 5: Choose the least exposed audience

Publishing a legacy artifact, or choosing “Anyone with the link,” is a broad-audience decision. Do not use it for internal drafts, customer data, private team tools, or content that assumes recipient identity. Prefer named invitations or organization sharing, and select only the members, access level, or Project scope actually needed.［2］［3］

Before confirming, record:

Field	Required decision
Route	Public publish, organization share, Project share, chat snapshot, or no share
Audience	Named roles or an intentionally public audience
Artifact version	Exact reviewed revision
Dependencies	Files, Project, MCP, network, storage, embeds
Recipient action	View, interact, copy code, enter data, or authenticate connector
Expiry/review	Time-bound review or recurring owner check

AethoVPN can protect the network path while a user opens Claude on an untrusted network, but it cannot remove private conversation context, change Artifact permissions, block copying, or undo a publication.

Step 6: Test from the recipient's perspective

Use an authorized account with the same role as the intended recipient. For public publishing, also test signed out. For organization sharing, avoid an owner/admin test account whose extra permissions could hide a denial or expose more Project data.

Run these checks:

The link opens the correct Artifact and correct version.
The recipient sees no unrelated conversation, attachment, file, Project knowledge, or navigation route.
Interactive inputs do not reveal previous users' data.
Personal and shared storage behave as the interface explains, including the shared-storage notice.［1］
Network requests go only to approved destinations and fail safely.
Copy, remix, download, and embed capabilities match the accepted audience model.
An unauthorized organization member or external account is denied where required.
Error states do not reveal internal endpoints, stack traces, or source content.

Record the account class, route, version, checks, and outcome. Do not capture private files in a screenshot merely to prove they were visible; stop, revoke access, and record a sanitized failure.

Step 7: Plan unshare, unpublish, and copied-content handling

Test revocation while the Artifact contains only synthetic data. For a current artifact, set access back to “Only you” or “Only people invited”; on Pro and Max, people invited by email keep access until you remove them. Legacy artifacts use Unpublish or Unshare, and Anthropic warns that an unpublished legacy artifact cannot be published again and that unpublishing permanently deletes its personal and shared storage data.［1］［2］

That makes rollback planning essential:

Export only the approved configuration or content needed to rebuild.
Do not use Artifact storage as the sole authoritative record.
Inform users before deleting shared state when the workflow requires it.
Verify the old link after unshare or unpublish.
Search the platform's management views for other published or shared versions.
Track known embeds and downstream copies, while recognizing the original link cannot revoke them.

If someone copied code from the public Artifact, treat that copy as independent. Anthropic recommends using code only from trusted creators; recipients should review it like any file from an unknown sender.［2］

Step 8: Review access and content over time

Recheck when the Artifact changes, Project membership changes, a connector is added, storage is enabled, public embedding expands, or the underlying claim becomes stale.

Maintain a register of owner, reviewed version, route, audience, dependencies, approval date, next review, and revocation evidence. The Claude beginner guide explains ordinary conversation controls; the AI privacy checklist covers broader minimization and data-use decisions.

Summary

Freeze the exact Artifact revision and purpose.
Map visible content, source code, conversation files, Project, connectors, network, storage, copies, and embeds.
Rebuild from minimum approved inputs instead of hiding private context.
Treat a published legacy artifact or any link share as public, and organization sharing as a narrower route.
Test with a representative recipient and unauthorized account.
Plan revocation and persistent-storage consequences before sharing.
Assume copied or embedded content may outlive the original link.

Frequently asked questions

Is a published Claude Artifact private if I share the link with one person?

No. Anyone with the link can open a published legacy artifact without an account, and “Anyone with the link” on a current artifact admits any signed-in Claude user who has the URL. Treat it as public even if you send it to one person.［2］

Can Team or Enterprise users publish an Artifact publicly?

Only if an owner allows it. Team and Enterprise artifacts stay inside the organization by default, and link sharing outside it needs External sharing or a per-artifact exception.［2］［5］

Can viewers see attachments and files from the creating conversation?

For an artifact made in a chat and shared on Team or Enterprise, Anthropic warns that viewers also get access to attachments and files in that chat. Audit the complete conversation.［2］

Does sharing an Artifact share the whole Project?

Not automatically, but a Project-created Artifact can require Project access. Project membership can expose Project knowledge and instructions, so use the narrowest suitable route.［2］［3］

Can I safely run code copied from a public Artifact?

Only after independent review. Treat copied code as untrusted, inspect dependencies and permissions, and test it in an isolated environment before granting real data or credentials.［2］

What happens to Artifact persistent storage when I unpublish?

Anthropic says unpublishing a legacy artifact permanently deletes its stored data. Preserve only authorized records elsewhere before relying on the action.［1］［2］

Does unsharing retrieve copies or screenshots?

No. It blocks future access through the original route but cannot retrieve content that recipients already copied, downloaded, embedded, or captured.

How often should I review a shared Artifact?

Review on a fixed schedule and after any content, audience, Project, connector, storage, network, or embed change. A new revision requires a new exposure review.

Disclaimer: Claude Artifact features, sharing routes, storage behavior, and plan availability can change. Verify Anthropic's current documentation and your organization policy before publishing confidential, regulated, or production-significant material.

Sources

Anthropic, “What are artifacts and how do I use them?” — https://support.claude.com/en/articles/17153992-what-are-artifacts-and-how-do-i-use-them
Anthropic, “Share artifacts” — https://support.claude.com/en/articles/9547008-publish-and-share-artifacts
Anthropic, “Manage project visibility and sharing” — https://support.claude.com/en/articles/9519189-manage-project-visibility-and-sharing
Anthropic, “Share and unshare chats” — https://support.claude.com/en/articles/10593882-share-and-unshare-chats
Anthropic, “Share session output as artifacts” — https://code.claude.com/docs/en/artifacts

Sources checked 4 October 2026.

How to Share a Claude Artifact Without Private Context