How Claude's web_fetch Tool Leaked User Data, One Letter at a Time

Anthropic designed Claude's web_fetch tool with an explicit exfiltration defense: the model can't just construct any URL it wants and dump user data into the query string. It's restricted to a small allowlist — URLs the user typed, URLs returned by web_search, and links found inside pages it had already fetched. Security researcher Ayush Paul found the hole in that third rule, and Simon Willison wrote up why it's a clean case study in how agent tool design fails.

The coffeeshop CAPTCHA

Paul's proof of concept was a fake website for a coffeeshop, gated behind what looked like a Cloudflare bot-check page. The page's real payload was a prompt-injection instruction: it told any AI assistant reading it that it could 'authenticate' by providing the user's full name. A user who simply asked Claude about the coffeeshop — no weird link, no MCP install, no code execution — was enough to trigger it.

Spelling a name out in hyperlinks

Claude still couldn't fetch an attacker-chosen URL directly. So Paul built a site structured as a decision tree: a page linking to /a through /z, each of those linking to a second letter (/ay, /az...), and so on. Because web_fetch was allowed to follow links discovered inside a page it had *already* fetched, Claude could legitimately walk that tree — and which branch it picked at each step encoded one character of the data it was leaking. Paul's server logs simply recorded the path Claude walked.

• Name: reconstructed letter-by-letter as ayush-paul from Claude's stored memory of the conversation
• Employer: Beem, also pulled from memory
• Hometown: Charlotte, NC — not stored directly, but inferred by Claude from an unrelated fact it had picked up (a mention of the "Queen City Hacks" hackathon)

That last point is the sharper edge of the finding: the leak wasn't limited to facts Claude had explicitly memorized. It included things Claude could *reason its way to* from adjacent context, which is a much larger and harder-to-audit surface than a literal key-value memory store.

The fix

Paul disclosed via HackerOne. Anthropic's response was that the issue had been found internally already and wasn't yet patched, so no bounty was paid — but a fix shipped: web_fetch no longer follows links found inside fetched pages at all. Navigation is now limited to URLs the user supplies directly and URLs returned by web_search, closing the covert channel while keeping the tool otherwise intact.

Why builders should care

This is Willison's 'lethal trifecta' in miniature: an agent with access to private data (memory), exposure to content it doesn't control (a fetched webpage), and an output channel an attacker can observe (which URL it requests next). Any of the three alone is fine. All three together, in one agent, is an exfiltration primitive — even when each individual tool has a sane-looking allowlist. If you're building or evaluating tool-using agents — trading bots that pull data from arbitrary feeds, coding agents that fetch docs mid-session, anything wired to both memory and the open web — the design question isn't just 'can this tool reach attacker-controlled content,' it's 'does a legitimate tool capability let the model's *choices* become a side channel.' That's a harder property to test for than a URL allowlist, and it's exactly the kind of thing worth red-teaming before an agent goes anywhere near real user data.