An Exfiltration Test Against a Consumer AI Assistant: A Researcher Asked Claude Which Coffee Shop Was Best. It Sent His Name to a Stranger.
A security researcher proved that Anthropic’s Claude can be induced to send a username, employer, and hometown to an attacker controlled server, using only what the product enables w/o configuration.
What Happened
On July 9, 2026, a security researcher named Ayush Paul published an account of an experiment he had run against Claude, the consumer chat assistant made by the artificial intelligence company Anthropic, which is reached through a web browser or a phone application and which replies in text to text a user types into it.¹
TL;DR:
Paul gave the assistant the addresses of several coffee shops and asked which of them had the best coffee. While the assistant composed its answer, it transmitted to a web server under Paul’s control, one character at a time, his full name, the name of his employer, and the name of the city where he grew up. The reply that appeared on his screen addressed the coffee shops and made no reference to the transmission.²
Nothing in the sequence required Paul to install software, enable an experimental setting, connect an outside service, or click a link in an email, and Paul states that he set out to find a route with those properties before he found this one.³
Memory and Chat Search
The information was available to be taken because of two capabilities that Anthropic documents in its public help center, the first of which lets the assistant search a user’s earlier conversations and reference them in a new one, and the second of which builds a standing record of the user, assembled from those conversations and supplied to the assistant at the start of new sessions.⁴
The company’s release notes record the arrival of both capabilities on paid plans between August 2025 and October 2025, and the extension of the standing memory record to free accounts on March 2, 2026.⁵
The help center states that search over past chats arrives switched on once it reaches an account, and that generating the standing memory record is governed by a separate toggle, which for organizations on Enterprise plans is enabled at the organization level by default and which, if an owner turns it off, permanently deletes the memory data of every user in the organization.⁶
The help center does not state a default for that toggle on individual consumer accounts. Paul writes that he selected memory as his target because it is on by default.⁷
Anthropic is currently operating two versions of the memory system at once, and the difference between them dictates what a deletion is supposed to accomplish.
Under the version that free, Pro, and Max accounts are being migrated to, the company states that memory entries generated from a conversation are not removed when that conversation is deleted, and that a user who wants them gone must delete them separately.
Under the version that Team and Enterprise accounts remain on, and which was the version in place when Paul ran his experiment, the company states that deleted conversations are removed from the memory synthesis.⁸
The URL Restriction
The assistant reaches the internet through two tools, one of which searches, and the other of which, called web fetch, retrieves the contents of a single address so the assistant can read the page.
Web fetch is read-only, and issues what is known as a ```GET``` request, which is the ordinary request a browser makes when it asks a server for a page, and which causes the address requested to be written into the log of the server that receives it, where it is visible to whoever operates that server.
The company’s developer documentation says that the assistant is not permitted to construct addresses on its own and may fetch only addresses that have already appeared in the conversation, which is a restriction the documentation presents as a measure against the case in which an attacker instructs an assistant to append a user’s private information to an address the attacker controls and then to visit it.⁹ That is the theory.
Paul asked the assistant to visit a page at an address containing his name, and the request never arrived at his server, which is the behavior the documentation describes.¹⁰
The Third Permitted Source
Paul then mapped which addresses the assistant will accept, and found three permitted sources, consisting of an address supplied by the user, an address returned by a web search, and an address linked from a page the assistant had already fetched.¹¹
The third source operates differently from the other two, because the assistant is permitted to follow links it finds on a page, and the links on a page are chosen by whoever owns the page.
Paul built a page whose links were the letters of the alphabet, so that the homepage offered twenty-six destinations, one for each letter, and each of those offered twenty-six more, generated on demand, with the result that any string of characters could be reached by descending through the structure. When he asked the assistant to spell his name through it, his server log recorded the first letter, then the first two, then the first three, continuing through the full ten characters.¹²
The Pretext Page
The class of attack at work here is called prompt injection, a term coined in 2022 by the developer and writer Simon Willison, and it names a condition in which a language model treats everything that reaches it as text to be understood and cannot reliably distinguish instructions written by its user from instructions written by a stranger and placed on a webpage the user asked it to read.¹³
In June 2025, Willison gave the name lethal trifecta to the combination of an agent that holds private data, is exposed to content an attacker controls, and possesses some means of communicating outward, a combination present in the configuration Paul tested, in which memory was switched on and a browsing tool was available.¹⁴
Paul reports that a page which simply demanded secrets did not work and that a fabricated loyalty program also failed, and that what succeeded was a page presenting itself as a bot-screening checkpoint of the kind operated by Cloudflare, an infrastructure company that provides such screening to other websites. The page told the assistant that automated visitors could now authenticate themselves by identifying the person they worked for, and that owing to the limitations of its fetching tool it would need to navigate, in the page’s words, letter by letter.¹⁵
Paul reports that the assistant navigated the structure without pausing to request permission, and that its reply to him contained the coffee shop’s seasonal menu and its hours.¹⁶
Paul then added further stages, so that a second page reported that multiple profiles matched the name and asked for the employer, and a third reported that the profile had been found and asked, as a security verification step, for the city the user grew up in, both of which the assistant spelled out through the same structure.¹⁷
The Inferred Hometown
Paul had never told the assistant where he was from, and the information was in neither his conversation history nor his stored memory record. In an earlier conversation he had mentioned a hackathon he founded in high school, called Queen City Hacks, and Charlotte, North Carolina, whose own municipal government describes the city by that nickname, is named for Charlotte of Mecklenburg-Strelitz, the queen consort of George III.¹⁸ The assistant drew the connection and spelled out Charlotte, and the reasoning appears in the published thinking trace ahead of the transmission.¹⁹
A user auditing what an assistant holds can open the memory panel and read the stored entries, and Anthropic states that the panel lists everything the assistant remembers, grouped by category.²⁰ The panel does not display the conclusions the assistant is capable of drawing from those entries at the moment it is asked.
Paul selected that third item, in his own framing, as a bank security question.²¹ The category has a formal status. The National Institute of Standards and Technology withdrew pre-registered knowledge tokens, the class that includes security questions, as an acceptable authenticator in Special Publication 800-63B, on the stated ground that they rely on information that is private but not secret.²²
User Agent Routing
Every request to a web server announces what kind of software is making it, in a field called the user agent, and Anthropic’s assistant identifies itself in that field.
Paul used that field to serve different pages to different visitors, so that a request from a browser received a coffee shop website with a menu and an address, and only a request identifying itself as the assistant received the checkpoint page.²³
A user, a colleague, a corporate security team, or a journalist opening the same address in a browser therefore receives the coffee shop page rather than the page the assistant received.
Paul also states that the user need not supply the address at all, because search results are a permitted source, so that a page ranked well for a subject the assistant searches could reach the assistant without any person having chosen to visit it, an extension he describes without reporting that he tested it.²⁴
What the Interface Displayed
The navigation appeared in the expanded reasoning view, of which Paul published a screenshot, while the collapsed reply, which is the view presented by default, contained an answer about the coffee shops.²⁵ The activity was therefore recorded in a panel the interface does not open by itself, in a form whose significance would not be evident to a reader who was not looking for it.
Disclosure and Response
Paul reported the finding to Anthropic through its bug bounty program, hosted on the platform HackerOne, and states that the company confirmed it had already identified the issue internally but had not yet fixed it, and that no bounty was paid.²⁶ Willison’s account, published July 15, 2026, describes the same disposition and attributes the internal-identification claim to the company.²⁷
The fix, as described by Paul and repeated in subsequent coverage, removed the third permitted source, so that the assistant no longer follows links found on pages it has fetched and reaches the web only through addresses the user provides and addresses returned by search.²⁸
What the Published Record Shows
Anthropic maintains a release notes page in its help center for the consumer product, and that page, reviewed for the period beginning July 1, 2026, carries entries dated July 1, July 7, July 9, July 10, July 14, and July 24, covering model launches, self-serve HIPAA configuration, the expansion of Claude Cowork to web and mobile, write permissions for the Microsoft 365 connector, a redesign of the memory system, and a monthly recap feature, and carrying no entry that describes a change to how the assistant follows links or that describes the exfiltration issue.²⁹
The developer documentation for the web fetch tool, checked on July 25, 2026 and again on August 11, 2026, listed on both dates the same three permitted sources for an address, the third of which is addresses returned by previous web search or web fetch results.³⁰ That documentation describes the tool as offered to software developers through the company’s programming interface, which is a separate product from the consumer assistant and is configured separately, and the reported fix was to the consumer assistant, so that the documentation establishes what the company tells developers about the developer tool and does not establish the current behavior of the consumer product.
The same documentation carries a warning from the company stating that enabling the tool where the model processes untrusted input alongside sensitive data creates data exfiltration risk, and advising that developers should, in its words, only use this tool in trusted environments or when handling non-sensitive data.³¹
The risk Paul demonstrated is therefore described by the vendor in the documentation written for developers, and the record as reviewed on both dates contains no corresponding notice in the material published for users of the consumer product.
The release notes further record that on July 10, 2026, the company replaced the memory system, moving from a summary regenerated every twenty-four hours to individual categorized entries written continuously, which is the change that produced the two arrangements described above.³² Nothing in the published record connects that change to Paul’s publication on the preceding day.
Prior Disclosures
A comparable chain against the same consumer product was disclosed four months earlier. On March 18, 2026, the research team at Oasis Security published findings on three flaws that could be chained against a default session with no integrations enabled, consisting of hidden instructions embedded in the address parameter that pre-fills the chat box, which were invisible in the text field but read by the model, together with extraction of conversation history through the company’s own file service using an attacker-supplied credential, and an open redirect on the company’s domain that allowed a search advertisement to display a trusted address while sending the visitor elsewhere. Oasis reported that the injection flaw was fixed and that the remaining issues were being addressed.³³
Willison’s 2025 essay lists the same class of attack demonstrated against Microsoft 365 Copilot, GitHub’s official integration server, GitLab’s assistant, Slack, Google Bard, Amazon Q, Google NotebookLM, GitHub Copilot Chat, Mistral, Grok, ChatGPT, and Anthropic’s own mobile application, among others, across a period of roughly two years.³⁴ Anthropic is among the vendors that had built a deterministic control against the class of attack before Paul’s disclosure, and Paul reports that the control prevented the assistant from constructing an address of its own.
What Is Not Established
There is no evidence in the public record that this technique was used against any member of the public. Paul ran it against his own account, using his own information, and reported it before publishing.
The fix is described by the researcher and repeated in subsequent coverage, and the coverage reviewed for this account contains no statement attributed to a named person at the company. This reporter has not independently tested the current behavior of the consumer assistant and takes no position on whether the mitigation is complete.
The developer documentation examined here describes an interface rather than measuring a system, and documentation can lag behavior in either direction.
The absence of a release note establishes that no release note was published and does not establish that no notice was given by another route.
Documented User Controls
Anthropic documents a set of controls that a reader can locate in the product, under which searching past conversations and generating memory are separate switches found under settings, memory can be paused, which stops new entries while preserving the existing ones, or reset, which deletes everything permanently and cannot be undone, and incognito conversations are available on every plan, including free accounts, and are excluded from chat history and from memory, with the qualification that on Team and Enterprise plans they remain available to organization owners through data export and are retained for at least thirty days. Stored entries can be viewed and deleted individually, and all memory data is included in data exports.³⁵
The same article documents two limits on those controls, stating that under the current arrangement deleting a conversation does not delete the memory entries derived from it, and, in the section addressed to Enterprise owners, that individual user memory edits are not logged.³⁶
The Underlying Configuration
The specific route Paul used has been closed, and the configuration that produced it remains in place.
An assistant that holds a durable record of a person, reads content that person did not write, and can reach addresses on the internet retains a path from the first capability to the third, and closing a particular path does not remove that property.
Paul makes the same point in his closing paragraph, writing that memory was the easy target, chosen because it is on by default, and that the same technique reaches whatever else the assistant can retrieve on a user’s behalf, including a connected document drive, an inbox, or an integration configured earlier and left in place.³⁷
End Notes
1. Ayush Paul, “The Memory Heist,” ayush.digital, July 9, 2026. https://www.ayush.digital/blog/the-memory-heist. Retrieved August 11, 2026.
2. Paul, “The Memory Heist.” The server log excerpts and the final reply are reproduced in the post. The employer named in the logs is Beem, and the city is Charlotte, North Carolina.
3. Paul, “The Memory Heist.” Paul states that he sought an exfiltration route requiring no experimental settings, no code execution, and no specialized integration.
4. Anthropic, “Use Claude’s chat search and memory to build on previous context,” Claude Help Center. https://support.claude.com/en/articles/11817273-use-claude-s-chat-search-and-memory-to-build-on-previous-context. Retrieved August 11, 2026.
5. Anthropic, “Release notes,” Claude Help Center. https://support.claude.com/en/articles/12138966-release-notes. Retrieved July 25, 2026. Search over past conversations reached Max, Team, and Enterprise accounts on August 11, 2025. The standing memory record reached Team plans on September 11, 2025, Enterprise plans on September 18, 2025, Max and Pro plans on October 23, 2025, and free accounts on March 2, 2026.
6. Anthropic, “Use Claude’s chat search and memory,” sections headed Search and reference past chats, Enable Claude’s memory, and Controls for Enterprise plan owners.
7. Paul, “The Memory Heist,” closing section.
8. Anthropic, “Use Claude’s chat search and memory.” The article states that an improved memory experience is being introduced, that it is the default for new users, that users on free, Pro, and Max plans are being migrated to it, and that users on Team and Enterprise plans remain on the legacy experience. Under Data retention and privacy in the current sections, the article states that memory entries generated from a conversation are not removed when that conversation expires or is deleted. Under Data retention and privacy in the legacy sections, it states that deleted conversations are removed from memory synthesis.
9. Anthropic, “Web fetch tool,” Claude Platform Docs. https://platform.claude.com/docs/en/agents-and-tools/tool-use/web-fetch-tool. Retrieved August 11, 2026.
10. Paul, “The Memory Heist,” section headed the naive approach.
11. Paul, “The Memory Heist,” section headed the complex approach. The same three sources are documented by Anthropic under the heading URL validation. See note 9.
12. Paul, “The Memory Heist.” The server log recording the character-by-character ascent is reproduced in the post. The string spelled was the researcher’s hyphenated name, ten characters in length.
13. Simon Willison, “The lethal trifecta for AI agents: private data, untrusted content, and external communication,” simonwillison.net, June 16, 2025. https://simonwillison.net/2025/Jun/16/the-lethal-trifecta/. Willison states in the same piece that he coined the term prompt injection in 2022 and distinguishes it from jailbreaking.
14. Willison, “The lethal trifecta.”
15. Paul, “The Memory Heist,” section headed tricking Claude. The page text is reproduced in the post and quoted in part by Willison. See note 27.
16. Paul, “The Memory Heist.”
17. Paul, “The Memory Heist.” Interactive reconstructions of each stage are published in the post.
18. Paul, “The Memory Heist,” and City of Charlotte, “About Charlotte.” https://www.charlottenc.gov/Growth-and-Development/Economic-Development/About-Charlotte. Retrieved August 11, 2026. The city’s own description states that Charlotte is nicknamed the Queen City and that the city and its county are named in honor of Charlotte of Mecklenburg-Strelitz, queen consort of King George III at the time of the city’s founding.
19. Paul, “The Memory Heist.” A screenshot of the expanded reasoning trace is published in the post.
20. Anthropic, “Use Claude’s chat search and memory,” section headed View and manage your memory.
21. Paul, “The Memory Heist.” Paul introduces the third stage with that characterization, and writes in the opening section that an accumulated conversation history could be used for bypassing security questions.
22. National Institute of Standards and Technology, “B.4 Authenticators and Verifiers,” SP 800-63-3 Implementation Resources. https://pages.nist.gov/800-63-3-Implementation-Resources/63B/Authenticators/. Retrieved August 11, 2026.
23. Paul, “The Memory Heist,” section headed tricking the user, including the user-agent routing diagram. The assistant identifies itself with the string Claude-User.
24. Paul, “The Memory Heist.”
25. Paul, “The Memory Heist.” The collapsed and expanded views are both published in the post.
26. Paul, “The Memory Heist,” section headed disclosure.
27. Simon Willison, “How I tricked Claude into leaking your deepest, darkest secrets,” simonwillison.net, July 15, 2026. https://simonwillison.net/2026/Jul/15/claude-web-fetch-exfiltration/. Retrieved August 11, 2026. Willison writes that the company claimed prior internal identification.
28. Paul, “The Memory Heist,” section headed disclosure. See also “This Week in Security,” Hackaday, July 24, 2026. https://hackaday.com/2026/07/24/this-week-in-security-ai-is-a-mess-hacking-car-chargers-an-openssl-dos-and-factories-under-attack/ and “Researcher says Claude memory attack leaked personal data,” WinBuzzer, July 16, 2026. https://winbuzzer.com/2026/07/16/researcher-says-claude-memory-attack-leaked-personal-data-xcxwbn/
29. Anthropic, “Release notes.” Reviewed for the period July 1 through July 25, 2026.
30. Anthropic, “Web fetch tool,” section headed URL validation. The section lists addresses appearing in user messages, addresses in client-side tool results, and addresses from previous web search or web fetch results.
31. Anthropic, “Web fetch tool,” security advisory preceding the section headed How web fetch works.
32. Anthropic, “Release notes,” entry dated July 10, 2026, and “Use Claude’s chat search and memory,” which describes the current arrangement as individual entries read, written, and updated in real time, and the legacy arrangement as a synthesis updated every twenty-four hours.
33. Elad Luz, “Claudy Day: Chaining Prompt Injection and Data Exfiltration in Claude.ai,” Oasis Security, published March 18, 2026, updated May 27, 2026. https://www.oasis.security/blog/claude-ai-prompt-injection-data-exfiltration-vulnerability
34. Willison, “The lethal trifecta.” The catalogue of prior incidents appears under the heading noting that the problem is a common one.
35. Anthropic, “Use Claude’s chat search and memory,” sections headed Enable Claude’s memory, What Claude doesn’t remember, Data retention and privacy, and User controls and visibility, together with the subsection on incognito chats under Controls for Enterprise plan owners.
36. Anthropic, “Use Claude’s chat search and memory,” sections headed Data retention and privacy and Audit logging and data exports.
37. Paul, “The Memory Heist,” closing section.