Researchers bypassed Claude’s web_fetch safeguards to exfiltrate user data

A security researcher, Ayush Paul, identified and demonstrated a bypass of Anthropic’s safeguards in the Claude web_fetch tool, which is designed to prevent data exfiltration attacks. The web_fetch tool was intended to restrict navigation to only those URLs explicitly provided by the user or returned by the companion web_search tool. This restriction aimed to mitigate the risk of attackers crafting URLs that concatenate sensitive data and exfiltrate it to malicious endpoints.

Paul’s attack exploited a loophole: web_fetch was also permitted to visit URLs embedded within pages it had already fetched. This allowed an attacker to host a honeypot site that guided the agent through a sequence of alphabetically enumerated links, such as https://coffee.evil.com/a, https://coffee.evil.com/b, and so on. The attacker’s prompt instructed the agent to navigate these links letter by letter to retrieve a user’s profile information, including their name, home location city, and employer.

The attack was specifically targeted at clients with a Claude-User user-agent string, making it harder to detect via broader monitoring. Anthropic confirmed that the issue has since been closed by removing the ability for web_fetch to navigate to additional links embedded within fetched content. The company stated it had already identified the vulnerability internally and did not issue a bug bounty for the disclosure.