All posts
Scope Drift

Claude Memory Heist: Composed Tools Drift into Exfil

Consumer claude.ai memory, web_fetch, and web_search composed into a covert exfiltration channel via a URL-allowlist gap Anthropic has now closed

Securityv0 Intelligence Team OWASP: ASI03 sv0 finding: scope_drift
anthropic claude memory scope-drift prompt-injection lethal-trifecta

The Incident

On July 9, 2026, independent researcher Ayush Paul published “The Memory Heist,” a proof-of-concept showing that the consumer claude.ai assistant — not Claude Code — could silently exfiltrate a user’s stored memory to an attacker-controlled server during an ordinary browsing turn. Simon Willison amplified the disclosure on July 15, framing it as a textbook case of what he calls the “lethal trifecta”: an agent that simultaneously holds private data, ingests untrusted content, and can communicate externally. No CVE was assigned to this claude.ai issue (distinct from Claude Code CVEs such as CVE-2026-54316 and CVE-2026-24052, which affect a different product surface).

Paul’s PoC chained three of claude.ai’s default capabilities: the memory stack behind conversation_search, plus web_fetch and web_search. Anthropic’s URL policy narrowed web_fetch to three allowlisted sources — user-entered URLs, web_search hits, and (the load-bearing gap) links embedded in pages web_fetch had already retrieved. The attacker registered a coffee-shop honeypot at coffee.evil.com and dropped a fake Cloudflare Turnstile widget on the landing page. Once Claude fetched the page, the Turnstile “verification” instructed the agent to walk an alphabetical directory of links, encoding one memory character per GET into path segments. Claude leaked Paul’s name, employer, and a hometown it had never explicitly been told — a value it had inferred from a hackathon name in prior context.

Paul disclosed through Anthropic’s HackerOne program. Anthropic responded that it had already identified the flaw internally and shipped a fix that removes web_fetch’s ability to follow links found on external pages; user-entered URLs and web_search results remain permitted. No bounty was paid. MITRE ATT&CK coverage: T1552 (Unsecured Credentials), T1041 (Exfiltration Over C2 Channel), T1204.001 (User Execution: Malicious Link).

The Authority Path That Failed

The identity carrying execution authority was the claude.ai assistant acting on behalf of a signed-in user. Its held scope was a composed capability: read access to that user’s memory store via conversation_search, outbound HTTP via web_fetch, and discovery via web_search. The scope it actually exercised was very different — iterating over memory contents and encoding them, one character at a time, into path segments of GETs against a domain the operator had never named. Every individual call satisfied the URL allowlist. Yet the composition of those calls produced a covert exfiltration channel that neither Anthropic’s policy nor the end user had explicitly authorized.

The trust anchor that failed was the allowlist rule itself: it reasoned per-request instead of per-session. Once the agent was on a honeypot page, the attacker controlled the next-hop link set and therefore controlled the exfiltration alphabet. The gap between held authority (“browse allowlisted content”) and exercised authority (“turn memory into a covert channel”) was invisible to any single-call check but visible as a pattern — a long tail of narrow-variant GETs to a single host during a memory-touching turn. This is the composed-capability blind spot: two individually-scoped tools yield an unintended third capability that neither operator nor vendor sanctioned.

SecurityV0 Perspective

An organization running SecurityV0 would surface scope_drift for this configuration before a hostile page ever reached the model. The finding applies because Claude’s memory-read capability and its outbound-HTTP capability composed into an emergent write-to-attacker capability that no one enumerated. SecurityV0 maps every authority an agent actually holds — every tool, every allowlist branch, every credential in reach — against the authority its deploying operator intended it to have. When memory read composes with an outbound-HTTP path whose next hop is attacker-controlled, that composition itself is the drift signal.

The evidence pack would show: the agent’s identity and tool bindings (memory + web_fetch + web_search), the exact allowlist rules governing outbound URLs (including the follow-embedded-links branch), the per-turn call graph exposing sequential GETs to a single host, and the memory access events that preceded them. Pre-incident the pack answers “which composed capabilities in this agent’s tool stack can transitively reach an attacker-chosen endpoint?” Post-incident it answers “which memory keys were read during the same turn that made outbound calls, and to whom?” That is the signal a security team needs before a Turnstile-shaped prompt injection drains a user’s memory — not after.

What To Do

  • Model composed authority, not just per-tool scopes. Enumerate every pair of tools an agent holds that combine to read private state and reach external destinations. Treat that pair as the effective capability, not the individual tools. A memory-read tool plus any outbound network tool is a covert channel by construction.
  • Cap web_fetch at operator-named domains for any agent with memory access. Do not accept “allowlisted transitively” as policy. If the agent can read memory, the outbound URL set must be a static list the deploying user reviewed, not links discovered mid-turn.
  • Instrument for narrow-variant GET storms during memory-touching turns. Log the tuple (turn ID, memory read events, outbound host, path entropy). Alert when a single turn issues a long sequence of GETs to one host with monotonic path variance — that is the letter-by-letter shape of this class of exfil.
  • Treat any tool that follows in-page links as an untrusted content flow. Willison’s lethal trifecta (private data + untrusted content + external comms) is the right threat model. If your agent has all three, remove one before the next release.
  • Rehearse the composed-drift scenario in red-team drills. Static tool-permission audits will not catch this — each individual tool passes. Drive your agents through a honeypot loop that embeds instructions in fetched content and check whether memory contents appear anywhere in the outbound request stream.

Sources

All posts