Bottom line: Nested links on a malicious website enabled Claude to exfiltrate sensitive user data such as name, location, and employer via URLs, despite Anthropic having implemented protective measures.
Security researcher Ayush Paul demonstrated a vulnerability in Claude’s web_fetch tool that allows private user data to be extracted. Anthropic has since closed the gap.
Anthropic had equipped the web_fetch tool with strict rules to prevent data exfiltration: the tool may only visit URLs that the user has entered themselves or that were returned by the accompanying web_search tool. This was intended to prevent Claude from transmitting user data to an attacker’s system at the instruction of a malicious website.
However, Paul discovered a loophole: web_fetch was also permitted to follow URLs embedded in the content of already-fetched pages. This made it possible to create a so-called honeypot website that would lead Claude through a sequence of nested links to exfiltrate data. The exploit used a fake authentication page (disguised as Cloudflare protection) that instructed Claude to search user profiles alphabetically while extracting the user’s name, location, and employer. The attack chain was only displayed to browsers with the User-Agent identifier “Claude-User” to make detection more difficult.