Prompt injection turns Claude's web-fetch tool into a memory-exfiltration channel

Security researcher Ayush Paul demonstrated a way to siphon sensitive personal data out of Claude.ai’s memory system by abusing its built-in web browsing. Claude’s memory has two parts: a daily pass that distills recent chats into a personal profile injected into every conversation, and a conversation_search tool that retrieves full history on demand. Together these hold unusually dense profiles—names, employers, hometowns, even the answers people give to security questions—making them attractive targets for blackmail, impersonation, or bypassing account-recovery checks.

The exfiltration vector is web_fetch. Anthropic already blocks fetching arbitrary URLs, allowing only links that appear in the user’s message, in web_search results, or in the content of a prior web_fetch result. Paul weaponized that third rule: he built a site whose pages link to /a, /b, /c and so on, with each page generating deeper links (/ay, /ayu, /ayus…). Because Claude can only follow links it has already seen, this alphabetical tree effectively hands the model a keyboard—each navigation step leaks one character to the attacker’s server, reconstructing arbitrary strings letter by letter.

Getting Claude to cooperate required social engineering rather than a crude “ignore all instructions” injection. Paul disguised the attacker site as a coffee shop guarded by a fake Cloudflare “turnstile” that claimed AI assistants must authenticate by spelling out their user’s full name to gain access, then served a convincing menu page afterward so the agent never realized it had been conned. The takeaway: AI memory stores now rival password managers in sensitivity yet get little security scrutiny, and pairing them with autonomous web-browsing agents opens invisible, general-purpose data-leak channels that don’t depend on experimental features or custom tooling.