Mechanism◆Article
web_fetch's rule allowing it to follow links embedded within previously fetched pages created a loophole for a honeypot site to chain nested links and exfiltrate data.
Ayush Paul discovered that because web_fetch could follow links found within pages it had already fetched, an attacker could build a honeypot site that lures the agent through a chain of generated links to leak data. ✦ AI generated
Ayush Paul · Simon Willison's Weblog · 2026-07-15 · original ↗
web_fetch was also allowed to visit URLs embedded in pages that it had previously fetched, which meant you could create a honeypot site which encouraged the agent to exfiltrate data by following a sequence of nested generated links.
Read full article ↗excerpt · fair-use quotation
- ·web_fetch could follow links found in fetched pages
- ·This let attackers chain nested generated links
- ·Honeypot sites exploited this to exfiltrate data
- ·Agent fetches attacker's honeypot page first
- ·Page embeds a link to a second page
- ·Agent follows nested links, leaking data along the way
Around this claim
This moment responds to
rebuts → Anthropic's web_fetch tool defends against exfiltration by only allowing navigation to exact URLs the user typed or that came back from web_search.Simon Willison · Simon Willison's Weblogexplains mechanism → The attack succeeded in extracting the user's name, home city, and employer name.Simon Willison · Simon Willison's Webloggives example → Because a single agent harness combines multiple permissions (e.g. Salesforce and email access), conventional guardrails that secure each system individually cannot stop the agent from moving sensitive data across those permission boundaries itself.Dev Rishi · The TWIML AI Podcast