Researcher tricked Claude into leaking data

Independent researcher Ayush Paul found a way to make Claude leak a user’s personal information to an external website, using only its web_fetch tool, which is restricted to read-only GET requests and, in theory, cannot send data anywhere on its own.

The trick exploited how web_fetch decides which links it is allowed to follow: URLs given directly by the user, URLs from web_search results, or URLs hyperlinked from a page web_fetch had already loaded. Paul built a site with a directory of single-letter pages, /a, /b, /c, and so on, behind a fake Cloudflare verification screen that told Claude it needed to “authenticate” by navigating to pages spelling out the user’s name, employer, and hometown, one letter at a time. Because each click was just Claude following an already-fetched page’s own link, it fell inside the tool’s allowed pattern, and Claude complied silently, leaking the data through which pages it requested, without ever alerting the user that anything had happened.

Anthropic’s fix, per the disclosure, was to disable web_fetch’s ability to follow links found on external pages entirely, limiting it to URLs from web_search results and URLs the user supplies directly. No bounty was awarded; the company says it had identified a related issue internally before this disclosure.

The underlying lesson generalizes past Claude. Any agent tool that fetches URLs and then follows links it finds on the fetched page creates a channel for exfiltration, because the sequence of requests itself becomes the payload, no outbound POST required. If your own agent stack includes a browsing or fetch tool, check specifically whether it follows links discovered on already-fetched pages, and if so, whether that path is scoped as tightly as the one Anthropic just closed. See when an email can hijack your ai for the broader family of prompt-injection-driven exfiltration risks.