Researcher Discloses a Claude Memory-Heist Flaw: Names and Employers Could Be Encoded Into Links and Exfiltrated

An attack on "AI memory"

Per IThome (July 17), security researcher Ayush Paul published a post (The Memory Heist) on July 9 disclosing an attack on Claude: sending a user's stored personal info (such as name and employer) to an external site without the user's knowledge.

The memory mechanism as attack surface

Paul notes Claude can summarize past conversations and recall them in new sessions, with two memory parts: ① daily summaries compressing recent chats into later sessions; ② a conversation_search tool for on-demand retrieval of full history. This grounds answers in user context, but over time accumulates a fairly complete profile — name, employer, hometown, work details, even personal troubles.

How the attack works

In tests, Paul says Claude handed over name, company and hometown with no extra prompting, with logs showing exfiltrated fields like "Name: Ayush Paul," "Company: Beem," "Hometown: Charlotte, NC." The method: mix a malicious URL with a real cafe URL and ask Claude to compare them; Claude would then, without asking permission, encode the name character-by-character into a link; with further prodding, current employer and even a hometown usable for bank identity checks could leak.

Response and takeaway

Paul filed via Anthropic's HackerOne bounty program; the disclosure says Anthropic already knew internally but hadn't fixed it at submission, and no bounty was paid. Anthropic subsequently disabled web_fetch following external in-page links. The case highlights a broader risk: when an AI assistant holds both "long-term memory" and "access to external URLs," the combination can be coaxed into a data-exfiltration channel — the richer the memory and freer the browsing, the larger the attack surface.