Event ·Multi-source

黑客利用Claude web_fetch漏洞窃取用户隐私

安全研究员Ayush Paul发现Claude的web_fetch工具存在数据泄露漏洞。攻击者可创建恶意网站，通过嵌套链接诱导Claude自动访问URL，从而窃取用户姓名、家庭城市和雇主信息。该漏洞源于web_fetch允许访问先前获取页面中的嵌入链接。Anthropic已修复此问题，移除了web_fetch跟随自身获取内容中链接的功能。

Current read

Ayush Paul演示了如何让Claude泄露你保存的个人信息，Anthropic已修复但值得了解攻击手法。

11 sources72° AI heatLast updated 2026/7/15 14:21:54

Evidence

11 sources

Primary sourceSimon Willison’s Weblog

2026/7/15 14:21:54View source

Related source 1IT之家

2026/7/17 07:28:57View source

Related source 2Latent Space (swyx)

2026/7/14 01:22:27View source

Related source 3Anthropic: Research

2026/7/14 13:44:30View source

Related source 4Decoder

2026/7/13 14:28:50View source

Related source 5techcrunch

2026/7/13 15:34:59View source

Related source 6The Rundown AI

2026/7/13 15:56:58View source

Related source 7AI 热点 · 原创

2026/7/13 16:17:43View source

Related source 8elvis

2026/7/13 17:27:07View source

Related source 9SuperTechFans

2026/7/14 01:01:57View source

Related source 10Claude Code: GitHub Releases

2026/7/14 01:10:42View source

Conflict check

Dedup data only shows that these sources discuss the same event, not that they agree. There is no structured supporting or refuting evidence yet, so no conflict is inferred automatically.

Open the story