Why Old Cloud Storage Sharing Links Can Still Expose Your Files

A file shared through a cloud storage link years ago does not expire on its own. The link stays live, and anyone who has it — or who stumbles onto it through a forwarded email or a hacked inbox — can still open it, according to a product guide published by WIRED on Nov. 14, 2026.

That is the mechanism at the center of a routine but overlooked security gap: cloud sharing links from services such as Google Drive, Microsoft OneDrive, and Apple iCloud are, by default, well protected when first created. The risk grows with time, not with the initial share. WIRED's guide notes that "the longer they stick around, the bigger the risk gets," since a link can get "mistakenly forwarded in an email" or exposed if "one of your contacts could have their email account hacked."

What risk do old cloud sharing links actually pose?

The core exposure is access, not necessarily a breach. A live share link grants whoever holds the URL entry to the file or folder behind it, and, depending on the permissions the original sharer set, that access can include viewing, editing, or deleting content. WIRED's guide frames the danger as cumulative: a link created for a one-time purpose, like sending a document to a colleague, often remains active long after the task is finished, with no built-in reminder to the account holder that it is still open.

How does Microsoft OneDrive's sharing permission system work?

OneDrive routes link management through the "Shared" tab in the navigation pane of the OneDrive web portal. Selecting "By you" at the top of the file list surfaces every item currently shared with others, and the "Modified" header can sort that list by date to spot the oldest links first. From there, clicking the three dots next to a file or folder opens "Manage access," where specific people can be removed individually or a link can be deleted outright via the trash-can icon. OneDrive also allows an expiration date to be set at the moment of sharing — accessible through the cog icon in the Share panel — which closes the link automatically rather than requiring a manual cleanup later.

How does Apple iCloud handle shared link management?

iCloud Drive's web interface places a "Shared" section in its own navigation pane, listing files and folders currently shared with other people. Unlike OneDrive, iCloud does not offer a built-in sort function for that list, though a search box in the top right corner can help locate a specific item. Clicking the three dots next to a file, then selecting "Managed Shared File," opens the controls needed to change or revoke access.

Why do shared links stay vulnerable over time?

The underlying problem is not the cloud providers' default security, which WIRED describes as "very well protected." It is the absence of a forcing mechanism to review links after their original purpose has passed. A link intended for a single recipient can be copied, forwarded, or exposed through a compromised account long after the sender has forgotten it exists. Because the permission structure travels with the link itself rather than the original context of the share, nothing in most systems flags that a three-year-old link is still open unless the account holder checks manually or sets an expiration at the outset.

What steps should users take right now?

WIRED's guide recommends a recurring audit rather than a one-time cleanup: periodically opening the "Shared" view in OneDrive or iCloud, sorting or searching for older entries, and revoking access for links no longer needed. For links created going forward, setting an expiration date in OneDrive's Share panel removes the need for a future audit on that file. The guide's broader point is procedural — treat sharing links the same way a password manager treats old credentials, as something that needs periodic review rather than a one-time setup.

The full walkthrough, including steps for Google Drive, is available in WIRED's guide on auditing cloud storage links.