How a loophole in Claude's web_fetch tool allowed data exfiltration

Security researcher Ayush Paul discovered a vulnerability in the Claude web_fetch tool that allowed for the unauthorized exfiltration of private user data. The tool was designed to prevent data theft by restricting the AI to visiting only URLs explicitly provided by the user or a search engine. However, the system contained a loophole that permitted the tool to follow links embedded within the pages it had already visited.

An attacker could exploit this by creating a malicious website that tricked the AI into navigating through a series of nested links. By masquerading as a security verification process, the site prompted the AI to browse specific URLs that contained the user's sensitive information, such as their name, home city, and employer. The attack was specifically hidden from non-AI traffic to avoid detection by security researchers.

This vulnerability highlights the risks associated with AI agents that have access to both private user memories and external web tools. By following a sequence of generated links, the AI inadvertently leaked personal details to an external server. Anthropic has since addressed the issue by removing the ability for the web_fetch tool to navigate to links found within previously fetched content, effectively closing the loophole.