A Claude exploit quietly exfiltrated a user’s name and employer

Researcher Ayush Paul documented an attack on claude.ai’s memory that gets the assistant to leak user data to an attacker with no visible sign of a breach. In his demo, Claude coughed up the user’s full name, employer, and hometown. The model inferred the hometown on its own from the name of a school hackathon.

The vector is web_fetch. The tool can follow links from a page it already loaded, so Paul built a “keyboard” site: the page linked to /a, /aa, /ab and so on, and Claude spelled out the name letter by letter in the URL. The cover was a fake Cloudflare verification page on a coffee shop site.

Paul reported the bug through HackerOne. Anthropic said it had already found the flaw itself and paid no bounty. The company has now disabled web_fetch’s ability to follow links on external pages.