Claude web_fetch Data Exfiltration Flaw Exposed
Simon Willison · rss · 2026-07-15
This Hacker News article details how a researcher bypassed Claude's webfetch tool restrictions to trick the model into leaking private information to external sites.
Key Points
- Standard Claude chats face the "lethal trifecta" risk: the model can access private memories, read malicious web content, and exfiltrate data via URLs.
- Anthropic's original restriction limited webfetch to exact URLs directly inputted by the user or returned by websearch.
- However, researchers discovered a loophole: webfetch could automatically follow embedded links on the pages it fetched. This allowed attackers to create a "daisy-chain" of links to gradually exfiltrate data.
- The article provides attack prompt snippets that disguise themselves as Cloudflare or site verification processes, sequentially accessing user profile pages in alphabetical order.
- The attack successfully leaked user names, cities of residence, and employer names.
Follow-up
- Anthropic did not pay a bug bounty, stating they had already identified the issue internally.
- The vulnerability has since been patched by removing webfetch's ability to follow additional links found within fetched content.
More from Safety
- An MCP server signs every AI agent tool call into a verifiable Merkle chain — Funky_Chicken_22 · 2026-07-22
- AI industry astroturfing roundup tracks the sector’s fake-grassroots problem — ShakeelHashim · 2026-07-22
- New paper defines self-state attacks, showing OS defenses leave four agent-memory cases indistinguishable — Justgototheeffinmoon · 2026-07-22
- Substack starts labeling AI-generated or AI-influenced writing — StewartalsopIII · 2026-07-22
- ControlAI CEO says an international ban on superintelligence is needed to avert extinction risk — zetalyrae · 2026-07-22
- Coding agents are heading toward an AI-writes, AI-reviews, human-approves workflow — aftahi_ai · 2026-07-22