Ayush Paul tricked Claude's web_fetch into leaking a user's name, city, and employer
Researcher Ayush Paul found that Claude's web_fetch — built to block exfiltration by visiting only user-entered or search-returned URLs — still followed links embedded in already-fetched pages, letting a honeypot walk the agent letter-by-letter to leak a user's name, home city, and employer. Simon Willison frames this as the structural 'lethal trifecta' — private-data access, untrusted content, and outbound network calls — not a one-off bug; Anthropic has since closed the hole by removing web_fetch's ability to follow links found within its own fetched content.
Source: simonwillison.net ↗
web_fetch was also allowed to visit URLs embedded in pages that it had previously fetched, which meant you could create a honeypot site which encouraged the agent to exfiltrate data by following a sequence of nested generated links.
Why this matters
- → Claude's web_fetch could be tricked into exfiltrating user data through nested links.
- → The vulnerability exploited a structural gap: pages can embed URLs that the agent follows.
- → Anthropic removed link-following within fetched content to close the attack surface.