Disclosed vulnerability
The Memory Heist: chaining web_fetch link-following letter by letter to spell out and exfiltrate a user's Claude memories
AIR-2026-0161 AIR record · 2026-07-anthropic-claude-memory-heist
From the supporting source
The URL being fetched must either be specified directly in the user message, be specified directly in the results of a `web_search` query, or be linked in the content of a previous `web_fetch` result.ayush.digital
The record
Disclosed
2026-07-15
Vendor
Anthropic
Product
Claude.ai (memory + web_fetch)
Risk domain
Privacy › Data exfiltration channels
System type
Generative model
Who acted
Agent acted — Claude followed the attacker's links letter by letter to spell out memories
Attack surface
Consumer assistant
Autonomy level
Assistant
Initial vector
Malicious website with user agent cloaking
Impact type
Data exfiltration
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI02 – Tool Misuse and Exploitation
- MITRE ATLAS
- AML.T0024 – Exfiltration via AI Inference API
- NIST AI RMF
- MAP 4.2
- EU AI Act
- Article 10
- ISO/IEC
- TR 24028; 23894
- AIUC-1
- A. Data & Privacy
- Scope
- tool misuse
- Mitigation
- Monitor network traffic for anomalous patterns; Restrict egress destinations.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
Claude.ai users with memory enabled who ask about an SEO-poisoned topic
Capability abused
Defense & remediation
Recorded defense
web_fetch URL restriction: URLs must come from the user message, web_search results, or a previous web_fetch result
Guardrail kinds
Unknown
Guardrail outcome
Silent
Fix shipped
Anthropic disabled web_fetch's ability to follow links found in fetched page content
Taxonomy & references
Curator notes
Independent researcher (Ayush, ayush.digital), surfaced via Simon Willison's prompt-injection and exfiltration-attacks tags. The bypass is elegant: rather than constructing one URL with the secret in it, the attacker's site serves 26 alphabetical links and Claude walks them letter by letter, spelling the secret across a sequence of allowed fetches. Site cloaks by user-agent so a human visitor sees benign content. Disclosed via HackerOne; Anthropic said it had identified the issue internally and awarded no bounty. Researcher's noted escalation: SEO-optimize a page about a news event and any user asking about it is caught.
Supporting sources
Cite as
Enkrypt AI. "The Memory Heist: chaining web_fetch link-following letter by letter to spell out and exfiltrate a user's Claude memories". AIR, AIR-2026-0161. https://agentincident.vercel.app/i/AIR-2026-0161/ (accessed 2026-10-19).