The Web Fetch Loophole: How a Security Researcher Exposed a Real Data Leak Risk in Claude
Reading Time: 5 minutesSecurity researcher Ayush Paul demonstrated a working prompt injection attack that used Claude’s web_fetch tool to leak a user’s name, city, and employer by chaining through embedded page links. Anthropic has since patched the loophole, but the broader challenge of AI tools reading hostile web content remains an open problem across the industry.