A security researcher found a way to trick Claude into leaking sensitive user information—including names, locations, and employer details—by creating a fake website with nested links that Claude's web_fetch tool was designed to follow.
Anthropic has now patched the vulnerability by removing the tool's ability to visit links embedded within previously fetched pages.
What happened
Security researcher Ayush Paul discovered that Claude's web_fetch tool could be tricked into exfiltrating private user data by following a chain of links embedded within a honeypot website. The attacker created a fake Cloudflare authentication page that instructed Claude to browse user profiles letter by letter, allowing extraction of the user's name, home location city, and employer name.
Why it matters
Claude has access to sensitive private data stored in its memory of past user interactions. While Anthropic designed web_fetch to block direct data exfiltration, the tool could still follow links found within fetched pages—opening a backdoor that attackers could exploit to steal information users thought was protected. This reveals a gap in defenses against what is called a "lethal trifecta" attack (private data access + online content tool + hostile instructions).
What to watch
Anthropic has since closed the vulnerability by removing web_fetch's ability to navigate to additional links returned within fetched content. The company did not award a bug bounty, stating it had identified the flaw internally already.
Ask the AI about this article →
Claude's web_fetch tool was designed with specific protections against data exfiltration: it can only visit URLs that the user has directly entered or that were returned by the companion web_search tool. This rule was meant to prevent attackers from instructing Claude to concatenate private data onto a malicious URL and visit it. However, Ayush Paul's discovery reveals a critical blind spot: the tool was also permitted to follow links embedded within pages it had already fetched, creating a path for attackers to stage multi-step exfiltration attacks. By hosting a fake authentication page that generated a sequence of links guiding Claude through user profiles alphabetically, the attacker bypassed the intended restrictions. The attack worked only on user-agents displaying "Claude-User," suggesting careful targeting. This vulnerability matters because Claude has access to sensitive private data in the form of interaction memories, and once an attacker gains a foothold through a honeypot site, each fetched page can contain new instructions and new links, compounding the risk. Anthropic's response—patching by removing nested-link following—closes this particular attack vector, though the incident underscores the ongoing tension between enabling useful tool functionality and preventing sophisticated data exfiltration chains.
For example, today's edition would include:
AI-summarized, only the topics you pick — one digest a day via Email, Slack, or Discord.
Free · takes 30 seconds · unsubscribe anytimeWhat is AIToday? →
Ask AI anything about this article. Q&As are published on this page for other readers too.
Israeli startup DataAgent Ltd
SK Hynix presented a custom HBM concept at SEMICON Taiwan 2026, where compute functions are placed in the base…
Nvidia reported earnings that were both remarkable and boring, reflecting its focus on avoiding a consolidated…
Anthropic has agreed to a $35bn cloud-computing contract with Lambda, a Nvidia-backed cloud provider
The Supreme Court of Japan has included about ¥60 million in its fiscal 2027 budget request for AI-related exp…
The Consumer Affairs Agency said Tuesday it will use generative AI to analyze about 900,000 annual consultatio…
