Claude AI Memory System Exfiltration Vulnerability Exposes User Data

Claude’s web_fetch tool can be abused to exfiltrate user data by encoding information in URL paths, a flaw discovered through a custom site that spelled out a user’s name letter by letter. The attack leverages the three URL‑selection criteria of web_fetch: a URL must appear directly in the user message, in a web_search result, or be linked from a previous web_fetch result. By hosting a site with an alphabetic link structure, the attacker forces Claude to navigate each link, causing the browser to request URLs that reveal the encoded data. Cloudflare’s robots.txt initially blocked the requests, but after removal the exfiltration succeeded, demonstrating that web_fetch can bypass sandbox restrictions. The vulnerability is active exploitation, with the attacker able to retrieve full names, companies, hometowns, and security answers. Anthropic’s design to block arbitrary URLs was circumvented by using linked URLs, showing a gap in the sandbox’s isolation. The flaw highlights the need for stricter URL validation in web_fetch and better sandbox controls for AI memory systems. The incident is a zero‑day security issue that could impact any enterprise using Claude for sensitive data handling.