Fetching from the wire…
01
02
03
04
05
06
07
08
Security2026-07-18 · source-backed
Ayush Paul's "Memory Heist" PoC, written up by Simon Willison, chained nested generated links: web_fetch was allowed to follow URLs embedded in pages it had already fetched, so each GET path smuggled one character out. The guardrail (only visit URLs the user typed or search returned) was bypassed transitively. Allowlist per-hop, not per-session. Fetched HTML is attacker-controlled link soup, always.
Each link below shares sources, entities, or timing with this story.
Anthropic released Claude / Shared entities / Earlier coverage
Linked by a graph relationship (Anthropic released Claude); both cover Ayush Paul, CLAUDE, GET; earlier Ayush Paul coverage from 2026-07-15.
Qwen benchmarked against Claude / Shared entity: Simon Willison / Same source domain / Shared topic / Earlier coverage / Tension
Linked by a graph relationship (Qwen benchmarked against Claude); both cover Simon Willison; reported by the same outlet (simonwillison.net).
Copilot uses Claude / Shared entities / Shared topic / Earlier coverage
Linked by a graph relationship (Copilot uses Claude); both cover Ayush Paul, CLAUDE; overlapping topics (claude, user).
Simon Willison uses Claude / Shared entities / Same source domain / Earlier coverage
Linked by a graph relationship (Simon Willison uses Claude); both cover Claude, Simon Willison; reported by the same outlet (simonwillison.net).
Linked by a graph relationship (Simon Willison uses Claude); both cover HTTP, Simon Willison; reported by the same outlet (simonwillison.net).
Linked by a graph relationship (Simon Willison uses Claude); both cover CLAUDE, Simon Willison; reported by the same outlet (simonwillison.net).
Linked by a graph relationship (Simon Willison uses Claude); both cover CLAUDE, Simon Willison; reported by the same outlet (simonwillison.net).
Linked by a graph relationship (Simon Willison uses Claude); both cover CLAUDE, Simon Willison; reported by the same outlet (simonwillison.net).