Claude's web tool exploited to leak user data through nested links

Claude's web_fetch tool was designed with specific protections against data exfiltration: it can only visit URLs that the user has directly entered or that were returned by the companion web_search tool. This rule was meant to prevent attackers from instructing Claude to concatenate private data onto a malicious URL and visit it. However, Ayush Paul's discovery reveals a critical blind spot: the tool was also permitted to follow links embedded within pages it had already fetched, creating a path for attackers to stage multi-step exfiltration attacks. By hosting a fake authentication page that generated a sequence of links guiding Claude through user profiles alphabetically, the attacker bypassed the intended restrictions. The attack worked only on user-agents displaying "Claude-User," suggesting careful targeting. This vulnerability matters because Claude has access to sensitive private data in the form of interaction memories, and once an attacker gains a foothold through a honeypot site, each fetched page can contain new instructions and new links, compounding the risk. Anthropic's response—patching by removing nested-link following—closes this particular attack vector, though the incident underscores the ongoing tension between enabling useful tool functionality and preventing sophisticated data exfiltration chains.