Ayush Paul Got Claude to Leak Its Memory

Claude leaked a user's personal data back to an attacker, one character at a time, after visiting a fake Cloudflare page, per Ayush Paul. The stakes: any agent holding a user's memory while fetching pages it didn't choose shares the same two ingredients Paul used here.

Paul found that Claude's web_fetch tool checks a URL against three criteria before visiting it. He built a chain of pages, each linking to the next, that slipped past the guard one hop at a time.

The last page in that chain served a fake Cloudflare turnstile, a lookalike verification checkbox shown only to visitors with the Claude-User user-agent. A person clicking the same link would never see it.

That page walked Claude into leaking the user's stored personal data letter by letter. Every request stayed GET-only, so nothing about the traffic looked like an upload or an obvious attack.

Anthropic patched the link-chaining bypass that got Claude onto the fake page in the first place. Paul's point is narrower and worse: the fix closes one path, not the shape, persistent memory paired with a tool that fetches attacker-controlled content.