If an agent tool reads untrusted content (a web page, an email, a shared file) and can take a further action based on it, you have a potential exfiltration channel even after blocking the obvious attack. Stopping the model from putting secrets into a URL is necessary but not sufficient. An attacker can walk the model through individually legitimate actions that add up to the same leak, one small piece at a time.
"},{"heading":"Short answer","html":"Closing the most direct exfiltration path does not close the channel. Claude's web_fetch already blocked the model from fetching a URL it built to encode private data. Ayush Paul found a second path: web_fetch could follow links found *inside a page it had already fetched*. A honeypot steered Claude through a chain of letter-indexed links and leaked a user's name, home city, and employer. Anthropic's fix removed link-following from fetched content.
Ask two questions of every content-reading tool:
\nThe source calls the underlying pattern the lethal trifecta: private data, untrusted content that can carry instructions, and any exfiltration vector. Closing one vector leaves the trifecta intact if another exists.
"},{"heading":"Mechanism","html":"The sequence is the signal. If untrusted content chooses which link the agent follows next, and that choice depends on a secret the agent knows, the server's access log spells out the secret. No single request carries data. In Paul's attack, a page posing as a Cloudflare bot check told Claude to "navigate letter by letter" to find the user's profile. Repeated fetches over predictable paths recovered three secrets character by character.
\nAllowed capabilities can be indistinguishable from attacks. web_fetch restricted fetches to user-entered URLs or web_search results, which blocked direct URL construction. Following a link inside a fetched page reads as ordinary browsing. The tool cannot tell "the page authored this link to run an exfiltration protocol" from "this is the natural next step". Anthropic removed the capability rather than trying to classify links.
Selective targeting evades generic scanning. The honeypot activated only for Claude-User user-agents. Scanners and human visitors saw nothing unusual, so blanket content filtering would not have caught it.
See prompt injection for the threat model this attack sits inside, and tool use for how ad-hoc tool integrations create unreviewed degrees of freedom.
"}],"evidence":[{"id":"paul-willison-2026-claude-web-fetch-exfiltration","kind":"production-field-report","tier":"production field-report-backed","title":"How I tricked Claude into leaking your deepest, darkest secrets","note":"Ayush Paul's attack on Claude's web_fetch, which already limited fetches to user-entered URLs or web_search results. web_fetch could still follow links inside fetched pages. A honeypot posing as a Cloudflare check had Claude walk alphabetically ordered nested links, leaking name, home city, and employer one hop at a time, and targeted only Claude-User user-agents. Anthropic removed link-following from fetched content and paid no bounty, saying it had found the issue internally.","added":"2026-07-17","url":"https://simonwillison.net/2026/Jul/15/claude-web-fetch-exfiltration/#atom-everything","sid":"5201cdda51e234b5"},{"id":"agent-tool-exfiltration-channels-editorial-synthesis","kind":"editorial-inference","tier":"editorial inference","title":"LLM Digest synthesis","note":"This is the 'lethal trifecta' the source names: private data access, exposure to untrusted content, and any exfiltration vector together are exploitable whichever single vector you close first. Any tool that reads untrusted content and can act on what it read is a potential exfiltration channel, even after the obvious exploit is blocked; the channel just moves slower through a legitimate-looking capability such as link-following.","added":"2026-07-17"}],"related_topics":[{"slug":"prompt-injection","title":"Untrusted input and tools can hijack an agent"},{"slug":"tool-use","title":"Agents reach the outside world through fragile, ad-hoc integrations"}],"related_playbook_cards":["pb-restrict-web-fetch-link-following"],"related_storylines":[]}