Claude web_fetch Nested-Link Data Exfiltration via Lethal Trifecta

Technical Analysis

Claude's chat agent combines access to private conversational memory with a web_fetch tool restricted to visiting only URLs explicitly entered by the user or returned by web_search — a mitigation against the 'lethal trifecta' (private data + untrusted content + exfiltration channel). The attacker set up a honeypot site that, once fetched, embedded further links (e.g. alphabetically enumerated subpaths) that the agent was induced via prompt injection to follow sequentially, effectively smuggling exfiltrated data (such as user identity attributes) into the fetched URL path itself, one character/hop at a time. Because the malicious page's content was treated as trusted enough to supply 'next' navigation targets, the tool's allow-list restriction was circumvented at the boundary between fetched content and subsequent tool calls. This let an external, untrusted webpage indirectly control and exfiltrate data from the agent's private context without ever needing a direct fetch of an attacker-supplied exfiltration URL.

Affected Systems

Claude (Anthropic web_fetch tool)

Detection Signatures

• Sequential/enumerated outbound fetch requests to a single external domain (e.g., /a, /b, /c... or letter-by-letter paths)
• User-agent conditional content serving specifically to 'Claude-User' or other AI-agent identifiers
• Web pages containing instructions directing an AI agent to 'authenticate' or 'browse profiles' via chained links
• Unusual repeated web_fetch tool calls to the same domain shortly after an initial fetch of an untrusted third-party page
• Prompt text referencing tool limitations ('due to limitations of your web_fetch tool') as a social-engineering cue

Remediation Steps

1. 1

   Restrict tool-driven navigation to user/search-originated URLs only

   Disallow web-fetch tools from following links discovered within previously fetched content; only permit navigation to URLs explicitly provided by the user or returned by a trusted search tool.

2. 2

   Sanitize and cap sequential fetch chains

   Detect and rate-limit patterns of many sequential fetches to the same domain/path structure, which can indicate character-by-character data smuggling.

3. 3

   Strip or ignore instructions embedded in fetched content

   Treat all fetched page content as data, not instructions; apply prompt-injection filtering before any content from web_fetch influences subsequent tool calls.

4. 4

   Isolate private memory/context from tool-calling decisions

   Ensure that data such as user profile/memory is not accessible to the component deciding which URLs to fetch next, breaking the lethal-trifecta chain.

5. 5

   Audit and red-team exfiltration channels

   Regularly test agent tools for indirect exfiltration paths (e.g., URL path encoding, nested links, nonstandard channels) beyond simple direct fetch restrictions.