Claude Code wants to publish an artifact.

The sentence, clause by clause

"Uploads the file below from this task to claude.ai." Claude writes the page to a file, in a temporary directory unless you named a location, and sends it to Anthropic's servers. The page is hosted there, at a claude.ai URL, not on your machine. After the first publish Claude prints the URL and your browser opens it.

"New artifacts stay private until you share them." The new page is visible only to you, signed in. It is not visible to your organisation yet, and not to anyone with the link. Sharing is a control in the page header in the browser, not something Claude Code does for you.

"If this file was already published in this task, that artifact is updated instead and keeps its current sharing settings." Publish the same file again and you get the same URL with new content, not a second page. Whatever audience you set stays set. That is convenient and it is also the one clause to read twice, below.

When it asks and when it does not

Publishing goes through the session's permission mode. In Manual and Accept-edits modes Claude Code asks, with a prompt along the lines of "Claude wants to publish deploy-failures.html to claude.ai to host as the page 'Deploy failures by service', private to you until you share it", and you choose Yes or No. In Auto mode the classifier reviews the publish instead of prompting, so a page can appear without you seeing a prompt. Anthropic's docs also say Claude may publish an artifact on its own when the output suits a page, so a request for "a dashboard of last week's failures" can come back as a URL rather than a file.

Which mode a session starts in depends on your plan. If you have been surprised by a link, that is where to look.

Who can see it, by plan

• Before sharing, every plan: only you.
• Team and Enterprise: specific people in your organisation, or everyone in it. A public link is possible only after an Owner enables public sharing for the organisation.
• Pro and Max: a public link is the only way to share. There is no org audience because there is no org.
• Any plan, artifact that uses a connector at runtime: on Pro and Max it stays private to you; on Team and Enterprise it stays within the organisation.

None of those options is "one person outside the company". A contractor, a client, a partner: the choice is org-only, which shows them a Page not found screen, or public.

Update in place, and the catch

Keeping the URL stable across re-publishes is the right behaviour for a page that is being worked on. The catch is in "keeps its current sharing settings". Once you have shared an artifact, every later publish in that session is shared the same way the instant it lands. A half-finished revision of a page you made public is public. If a page is going to be seen by others, do the sharing last, or work on a copy until the version is right.

The docs also list cases where Claude asks for permission again even for an update: when the page declares a runtime capability such as connector calls or file downloads, when you have shared it publicly, and when you have shared it with people or your organisation with the latest version selected as the one viewers see. Those prompts are worth reading rather than approving by reflex, since they are the moment a change goes live for an audience.

Getting it to someone outside the org

Tell Claude Code to publish the page to Stacktree instead. Claude Code can make that request itself, with no account and no key, and hands back a private link that opens for anyone you send it to, with no Claude account and no organisation check. If the content warrants it, add a passcode or a company email gate; if it goes onward to a client under your name, put it on your own domain. Updates work the same way, in place at the same link, and the paying-nothing route keeps a page for 24 hours unless you claim it into an account, so claim the ones that matter.

This is the same page Claude Code would have published to claude.ai, hosted where the audience is defined by the link rather than by membership.

Stopping it

Say No at the prompt. Run the session in Manual or Accept-edits mode if you want to be asked every time. Setting CLAUDE_CODE_ARTIFACT_AUTO_OPEN=0 in your environment stops the browser opening after a publish; it does not stop the publish. The dependable way to steer output is to say where it goes: a local file, a path in the project, or another host. Claude Code follows an explicit destination over its own judgement about what suits a page.