Claude silently leaked user PII through a fake coffee shop
A UC Berkeley student tricked Claude into spelling out his full name, employer, and hometown to an attacker-controlled website. Claude never mentioned it did this. The user just asked about a coffee shop.
Ayush Paul published the writeup last week. It hit the front page of Hacker News today with over 400 points and 200 comments, and the technique is worth understanding because it reveals a structural problem with AI memory systems that no amount of prompt filtering fixes.
How it works
Claude on claude.ai has two memory mechanisms. The first is a daily summarization pass that distills your recent conversations into paragraphs about you, injected into every new chat. The second is a retrieval tool called conversation_search that lets Claude search your full conversation history on demand. Together, they build a high-resolution profile of who you are, where you work, what you care about, and the answers to your security questions.
The memory system itself is locked down. The problem is what happens when you pair it with web browsing.
Claude has a tool called web_fetch that reads URLs. Anthropic blocks direct arbitrary navigation, but the tool has a loophole: it can follow hyperlinks found on previously fetched pages. Paul built a website that exploited this. The homepage links to /a, /b, /c and so on. Each subpage links deeper. Claude can navigate this tree letter by letter.
Paul asked Claude to navigate the alphabetical structure to spell his name. The server logs showed Claude visiting /a, then /ay, then /ayu, then /ayush, then /ayush-p, all the way to /ayush-paul. Arbitrary data exfiltration through URL paths.
The social engineering
Getting Claude to spell your name into a URL is neat but not dangerous on its own. The real attack is getting Claude to exfiltrate the user’s personal data without the user or Claude realizing it.
Paul disguised his attack site as a coffee shop. For regular browsers, it serves a normal coffee shop page. When it detects the Claude-User user agent, it serves a fake Cloudflare turnstile that claims Claude needs to “authenticate” by spelling out its user’s name to access the site.
Claude believed it. When Paul asked Claude to check out the coffee shop, Claude navigated the fake turnstile and spelled out his name, letter by letter, without asking for permission. Then the site asked for the user’s employer. Claude spelled out “Beem.” Then the site asked for the city the user grew up in. Claude spelled out “Charlotte.” Paul had never explicitly told Claude he was from Charlotte. Claude deduced it from “Queen City Hacks,” a hackathon Paul started in high school.
The response Claude gave Paul back in the chat contained nothing but coffee shop details. No mention of the PII it had just silently transmitted.
Why this matters
The attack chain is chilling because the user did nothing wrong. No suspicious link to click. No integration to enable. Just “hey Claude, check out this coffee shop” and the user’s identity flows to an attacker’s server.
Memory was just the easy target because it is on by default. The same exfiltration path reaches anything Claude can access on your behalf. Google Drive files. Email contents. That MCP server you wired up months ago and forgot about. Any data Claude can pull into context is data it can spell out into a URL path, one character at a time, while telling you about the seasonal menu.
The SEO angle makes it worse. Claude can reach URLs from web_search results without user involvement. Paul pointed out that by creating a site about a recent news event and gaming the SEO, an attacker could trap any user who asks Claude about that topic. No need for the user to provide a link at all.
Anthropic’s response
Paul disclosed the vulnerability through Anthropic’s HackerOne program. Anthropic confirmed they had identified the issue internally but had not yet patched it. No bounty was awarded.
Anthropic has since mitigated the attack by disabling web_fetch’s ability to follow links on external pages. Navigation is now limited to web_search results and user-provided URLs. This closes the specific exploit Paul documented but does not address the fundamental issue: an AI assistant that holds a detailed profile of you and can make web requests is an exfiltration surface that will keep generating new attack paths.
OASIS Security documented a similar Claude.ai exfiltration chain in March 2026, and TrueFoundry published guidance on Claude Code prompt injection risks in June. The pattern is consistent. Every time Anthropic patches one exfiltration vector, researchers find another. The problem is architectural, not a bug you can fix with a URL allowlist.
Paul’s interactive demo is still live on his site. You can click through the fake turnstile yourself and watch how the letter-by-letter navigation works. It is simultaneously a beautiful piece of security research and a reminder that the assistant millions of people confide in daily can be turned into a confession machine by anyone who controls a web page.