Claude’s reported “secrets leak” attack demonstrated a real prompt-injection exfiltration path...
**Claude’s reported “secrets leak” attack demonstrated a real prompt-injection exfiltration path through Claude’s then-allowed `web_fetch` link-following behavior and access to user memory, but it did not by itself prove random cross-user or cross-session memory bleed inside Claude’s base model**. The clearest public account, from [Simon Willison’s summary of Ayush Paul’s demo](https://simonwillison.net/2026/Jul/15/claude-web-fetch-exfiltration/), says the proof of concept could reportedly leak limited profile details such as **name, employer, and home city** to an attacker-controlled site.
That distinction matters. A tool-enabled agent being tricked into visiting a malicious page and then exfiltrating data from its available context is a serious security failure; it is not the same claim as “the model randomly spills other users’ secrets.” Anthropic’s later [engineering write-up](https://www.anthropic.com/engineering/how-we-contain-claude) describes the disclosed issue as one involving **allowed-domain exfiltration and persistent memory poisoning** and says the specific follow-on navigation path used in the demo was removed.
The reported attack worked because Claude could be induced to [fetch attacker-controlled web content and then follow embedded links](https://simonwillison.net/2026/Jul/15/claude-web-fetch-exfiltration/). That gave the attacker a route to deliver prompt-injection instructions through page content, have Claude read from the user’s available context or memory, and send selected details back out through a subsequent web request.
In Willison’s summary, the exposed information was reportedly **limited personal profile data**, including [a user’s name, employer, and home city](https://simonwillison.net/2026/Jul/15/claude-web-fetch-exfiltration/). That is a real privacy problem, but it is not a blanket dump of every Claude user record, and the public descriptions available here do not support that broader claim.
Anthropic’s own user-facing safety guidance says prompt injection becomes possible when Claude is [given access to untrusted external content or tools that can read or act on data](https://support.claude.com/en/articles/13364135-use-claude-cowork-safely). In other words, once an agent can browse, read remote content, and act on instructions embedded in that content, the web page is no longer just data. It is also input to the model’s control loop.
That is the same broad class of problem that shows up in other agent environments. In our earlier coverage of a [Claude Code harness leak analysis](https://novaknown.com/2026/04/01/claude-code-leak/), the load-bearing question was not whether the base model had mystical access to secrets, but whether the surrounding tool chain gave it a path to read and transmit them.
Anthropic’s engineering post makes the mechanism more concrete. The company says a third-party researcher disclosed an issue where C