Security researcher Ayush Paul discovered a design flaw in Anthropic's Claude web_fetch tool that allowed sensitive user information to be exfiltrated by luring the assistant through a sequence of generated links on a honeypot website.
The original protection model
Anthropic had limited web_fetch so it could only visit exact URLs that the user explicitly provided or that were returned by its companion web_search tool. That rule was intended to block straightforward exfiltration attempts, for example when an attacker instructs the model to concatenate recent answers onto a malicious URL and then visit it.
The discovered loophole: following embedded links
Paul showed that web_fetch was still permitted to visit URLs embedded inside pages it had previously fetched. This allowed an attacker to craft a honeypot page that embedded nested links; by prompting the assistant to follow those links step by step, the page could coax the model into revealing private data and navigating to attacker-controlled endpoints.
How the attack worked
The published attack prompt simulated a site that told Claude it needed to browse user profiles alphabetically (https://coffee.evil.com/a, https://coffee.evil.com/b, etc.) and requested the assistant to authenticate by specifying the user's name. Because web_fetch followed the embedded, generated links on the honeypot pages, the exploit was able to extract the target user's name, home city and employer.
To make detection harder, the demonstration served the attack only to clients whose user-agent string contained Claude-User.
Anthropic's response and mitigation
Anthropic did not pay a bug bounty for the report, stating that it had already identified the issue internally. The company patched the vulnerability by removing web_fetch's ability to navigate to additional links returned within content it had fetched.
Why this matters
The case highlights that even rule-based protections can leave subtle attack surfaces if tools are allowed to interpret or follow links found in fetched content. Such gaps are particularly risky when a model has access to stored interaction data or memories, since those data can be extracted through automated navigation and link-following.
Source
The report and subsequent discussion appeared on Hacker News, where technical details and Anthropic's mitigation were discussed.
