A security researcher found a way to exfiltrate personal data accumulated in Claude’s memory (name, employer, answers to security questions) to an external site controlled by the attacker. The vulnerability exploited web_fetch, the tool Claude uses to read web pages. Anthropic confirmed the issue and patched it by removing the ability to follow links found in already-downloaded pages.

Why this matters to you. Claude stores what you tell it. In long sessions you share sensitive information: work data, strategic decisions, sometimes personal details. The protection on web_fetch was considered solid: the agent could only visit URLs typed by the user or returned by internal search. The hole was in a seemingly innocent rule that allowed Claude to click links found inside pages it had already loaded. A specially crafted site could use this opening to extract data one character at a time, hiding it in the URL path.

If you use an assistant with memory and web access on sensitive data, this is the type of risk to understand. The patch has arrived, but the pattern is general: every time an agent has private memory and tools to communicate outward, the attack surface grows.

If you want to experiment. The vulnerability is already closed. What you can do is reduce risk when you have AI read third-party content: the playbook on how to defend against prompt injection is the starting point.

In detail

“Lethal trifecta” is the security community’s name for the most dangerous risk configuration for an AI assistant: access to private data, access to tools that read external content, and hostile instructions hidden in that content. Claude chat has all three ingredients. Claude’s memory, made up of a daily summary of conversations and a search tool for the complete history, builds dense user profiles. And web_fetch gives the agent the ability to load web pages, where malicious instructions can hide.

Anthropic’s protection was robust on paper. web_fetch could only visit three types of URLs: those typed directly by the user in a message, those returned by the web_search tool, or those found as hyperlinks inside an already-loaded page. The third rule seemed harmless: it was meant to let Claude click links it encountered while browsing, like a person would.

Ayush Paul realized the third rule was the entry point. If the attacker controls the website, they also control which links appear on the page. He built a site that worked like a keyboard: the homepage showed links to /a, /b, /c and so on. Each letter page linked to subpages (/aa, /ab, /ac). The attack prompt, disguised as a Cloudflare message asking the AI to “authenticate” by specifying the user’s name, invited Claude to navigate the site letter by letter. Each HTTP request logged on the attacker’s server revealed a character of the data extracted from memory.

The result: full name, city of residence, employer name. Data that Claude had in memory because the user had shared it in past conversations. The attack was invisible to whoever was chatting: no indication that anything had left the sandbox.

The attack was also selective: the honeypot site showed the malicious prompt only to clients with Claude-User in the user-agent, making it harder to discover for researchers or automated scanners.

Anthropic closed the vulnerability by removing the third rule. Now web_fetch no longer follows links found in downloaded pages: it can only visit URLs typed by the user or returned by web_search. It did not pay the bug bounty, arguing it had identified the issue internally before disclosure.

The patch is specific to this vector, but the risk pattern is general. Any tool that gives a model access to the network can become an exfiltration channel if the model can be instructed to encode data in request parameters. Assistant memory is becoming the most sensitive data many users possess: denser than a password manager, because it includes context and relationships, not just credentials.