Intel / article

How I tricked Claude into leaking your deepest, darkest secrets

Source: Simon Willison
Author: Simon Willison
Date: Published Jul 15, 2026

Key takeaways · AI-distilled

Claude's web_fetch was restricted to exact URLs the user typed or that web_search returned. That deterministically kills the classic attack of appending stolen data to evil.example.com/log?answers= and visiting it.
The hole was that web_fetch would also follow links found inside pages it had already fetched. One attacker-controlled page then becomes an unlimited supply of pre-approved URLs.
The exploit smuggled data out in the URL path. A fake Cloudflare "AI authentication" page told the to browse profiles letter by letter, so each fetch of coffee.evil.com/<letter> leaked one character.
The page served the attack only to requests carrying the Claude-User agent string, so a human opening the same URL saw nothing suspicious. It extracted the user's name, home city, and employer.
Anthropic's remedy was to delete the capability, not to filter it: web_fetch can no longer navigate to links returned inside its own fetched content.

Terms in this piece · Glossary

AI agent — An AI system that doesn't just answer once but works toward a goal in a loop — taking actions, reading the results, and deciding what to do next.

Why it matters

If your agent fetches web content and holds private data, this shows how deterministic URL restrictions fail via attacker-controlled nested links — check your own fetch tools for the same hole.

Key quotes

“Anthropic's protection is that web_fetch can only be used to navigate to exact URLs that the user has entered themselves or that were returned from its companion web_search tool.”

“web_fetch was also allowed to visit URLs embedded in pages that it had previously fetched, which meant you could create a honeypot site which encouraged the agent to exfiltrate data by following a sequence of nested generated links.”

“They were able to extract the user's name, home location city and the name of their employer.”

“Anthropic didn't pay out a bug bounty because they claimed to have identified it internally already, and have since closed the hole by removing the ability for web_fetch to navigate to additional links returned within its own fetched content.”

Read the source ↗simonwillison.net