The Memory Heist: How One Honeypot Page Walked Claude Out the Back Door
发布于 2026-07-16
A real prompt-injection attack on Claude's web_fetch tool exfiltrated user data via a fake Cloudflare honeypot. Case deconstruction + what it tells us about tool-using LLMs as a category.
The Memory Heist: How One Honeypot Page Walked Claude Out the Back Door
On 2026-07-15, security researcher Ayush Paul published a full disclosure of a prompt-injection vulnerability in Anthropic's Claude web_fetch tool. The attack needed three steps, one fake Cloudflare page, and no zero-days. It extracted the user's real name, home city, and employer. Anthropic's response: deny the bug bounty and quietly close the hole.
The disclosure matters less for Claude specifically than for what it proves about tool-using LLMs as a category. Any agent that can browse the web and remember what you told it can be turned into an exfiltration channel by someone who controls a page it visits. Claude's defense was the best in class. The defense failed anyway.
This is a deconstruction of the attack, the defense, and the structural problem underneath both.
The Setup: What Claude Was Supposed to Be Doing
Claude's regular chat has what Simon Willison calls the lethal trifecta: private data (your past conversations, stored as memories), a tool that reads hostile content online (web_fetch), and an exfiltration channel (the URLs that tool can hit). Any LLM with all three is structurally vulnerable to prompt injection — the attacker's text in the fetched page instructs the model to leak your data out through the same tool.
Anthropic's defense was precise. web_fetch was only allowed to navigate to URLs in two categories:
- URLs the user typed themselves.
- URLs returned by Claude's companion
web_searchtool.
