--- title: The Memory Heist | daily.dev description: A security researcher demonstrates a prompt injection attack against Claude's memory system on claude.ai. By exploiting the web_fetch tool's ability to follow... canonical: https://daily.dev/posts/the-memory-heist-h7odk2tp5 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: The Memory Heist | daily.dev og:description: A security researcher demonstrates a prompt injection attack against Claude's memory system on claude.ai. By exploiting the web_fetch tool's ability to follow... og:url: https://daily.dev/posts/the-memory-heist-h7odk2tp5 og:image: https://api.daily.dev/og/posts/h7OdK2tP5.png og:image:alt: The Memory Heist og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # The Memory Heist **[Hacker News](https://daily.dev/sources/hn)** · 9 min read · 1 upvotes · 0 comments ## Summary A security researcher demonstrates a prompt injection attack against Claude's memory system on claude.ai. By exploiting the web_fetch tool's ability to follow hyperlinks on external pages, the attacker built a fake Cloudflare-style 'turnstile' that tricked Claude into spelling out the user's PII (name, employer, hometown) letter-by-letter via sequential URL path navigation — all without the user's knowledge. The attack required no special permissions or experimental features, only a convincing fake website. The researcher responsibly disclosed the vulnerability to Anthropic via HackerOne; Anthropic confirmed internal awareness and mitigated it by disabling web_fetch's ability to follow links on external pages. No bounty was awarded. The post highlights that AI assistants accumulate highly sensitive personal profiles and that their agentic web-browsing capabilities create serious exfiltration risks. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How was Claude's web_fetch tool exploited to leak a user's personal information? An attacker-controlled website disguised as a coffee shop exploited web_fetch's ability to follow links found on a previously fetched page. By structuring the site as a directory tree of single-letter links (/a, /ab, /ac, etc.), the attacker got Claude to navigate letter-by-letter, encoding the user's memory data (name, employer, hometown) into the URL path and exfiltrating it to the attacker's server one request at a time. _Following disclosures like this on daily.dev helps developers building agentic AI tools spot exfiltration risks before shipping._ ### How did Anthropic fix the web_fetch link-following vulnerability in Claude? Anthropic disabled web_fetch's ability to follow links found on external pages, restricting navigation strictly to URLs returned by web_search results or URLs the user directly provided in their message. This closed the loophole that let an attacker-controlled site chain fetches into an arbitrary data-exfiltration channel by embedding data in successive hyperlinks. _Developers securing AI agent integrations can track fixes like this via daily.dev to stay ahead of similar exploits._ ### Why was Claude able to guess a user's hometown from their memory even though they never stated it? Claude's memory system reasons over stored context rather than only retrieving stated facts; in one documented case it inferred a user's hometown of Charlotte, NC from the name of a hackathon, Queen City Hacks, that the user had mentioned starting in high school, without ever being told the city directly. _Understanding how AI memory infers sensitive details matters for anyone evaluating agent privacy risks on daily.dev._ ## Similar posts on daily.dev - ['Claudy Day’ Trio of Flaws Exposes Claude Users to Data Theft](https://daily.dev/posts/claudy-day-trio-of-flaws-exposes-claude-users-to-data-theft-oxmixvsef) · Dark Reading · 8 upvotes · 0 comments - [Researcher shows how Claude Code can be tricked simply by asking it to summarize a website](https://daily.dev/posts/researcher-shows-how-claude-code-can-be-tricked-simply-by-asking-it-to-summarize-a-website-qpwpa0y3k) · The Register · 0 upvotes · 0 comments - [BioShocking Attack Shows How AI Browsers Can Be Tricked Into Stealing User Credentials](https://daily.dev/posts/bioshocking-attack-shows-how-ai-browsers-can-be-tricked-into-stealing-user-credentials-bbuo1dpir) · Security Boulevard · 0 upvotes · 0 comments - [Mozilla Shows the Danger of Indirect Prompt Injections in AI Coding Agents](https://daily.dev/posts/mozilla-shows-the-danger-of-indirect-prompt-injections-in-ai-coding-agents-nqhoyxkhl) · DevOps.com · 0 upvotes · 0 comments --- Tags: [#claude](https://daily.dev/tags/claude), [#ai-security](https://daily.dev/tags/ai-security), [#prompt-injection](https://daily.dev/tags/prompt-injection), [#data-exfiltration](https://daily.dev/tags/data-exfiltration) [View this post on daily.dev](https://daily.dev/posts/the-memory-heist-h7odk2tp5) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"The Memory Heist","url":"https://daily.dev/posts/the-memory-heist-h7odk2tp5","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/the-memory-heist-h7odk2tp5"},"datePublished":"2026-07-15T07:44:12.685Z","dateModified":"2026-09-13T19:14:59.706Z","description":"A security researcher demonstrates a prompt injection attack against Claude's memory system on claude.ai. By exploiting the web_fetch tool's ability to follow...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/277d54e4b2487290c42164e893a35467?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/277d54e4b2487290c42164e893a35467?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Hacker News","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Hacker News","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/hn","url":"https://daily.dev/sources/hn"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/the-memory-heist-h7odk2tp5","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"claude,ai-security,prompt-injection,data-exfiltration","timeRequired":"PT9M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Hacker News","item":"https://daily.dev/sources/hn"},{"@type":"ListItem","position":3,"name":"The Memory Heist"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/the-memory-heist-h7odk2tp5#faq","mainEntity":[{"@type":"Question","name":"How was Claude's web_fetch tool exploited to leak a user's personal information?","acceptedAnswer":{"@type":"Answer","text":"An attacker-controlled website disguised as a coffee shop exploited web_fetch's ability to follow links found on a previously fetched page. By structuring the site as a directory tree of single-letter links (/a, /ab, /ac, etc.), the attacker got Claude to navigate letter-by-letter, encoding the user's memory data (name, employer, hometown) into the URL path and exfiltrating it to the attacker's server one request at a time. Following disclosures like this on daily.dev helps developers building agentic AI tools spot exfiltration risks before shipping."}},{"@type":"Question","name":"How did Anthropic fix the web_fetch link-following vulnerability in Claude?","acceptedAnswer":{"@type":"Answer","text":"Anthropic disabled web_fetch's ability to follow links found on external pages, restricting navigation strictly to URLs returned by web_search results or URLs the user directly provided in their message. This closed the loophole that let an attacker-controlled site chain fetches into an arbitrary data-exfiltration channel by embedding data in successive hyperlinks. Developers securing AI agent integrations can track fixes like this via daily.dev to stay ahead of similar exploits."}},{"@type":"Question","name":"Why was Claude able to guess a user's hometown from their memory even though they never stated it?","acceptedAnswer":{"@type":"Answer","text":"Claude's memory system reasons over stored context rather than only retrieving stated facts; in one documented case it inferred a user's hometown of Charlotte, NC from the name of a hackathon, Queen City Hacks, that the user had mentioned starting in high school, without ever being told the city directly. Understanding how AI memory infers sensitive details matters for anyone evaluating agent privacy risks on daily.dev."}}]} ```