Covert Channels in AI Agent Toolchains

אִם יִרְצֶה הַשֵּׁם

The Read-Only Lie

Ayush Paul published The Memory Heist on July 9. He built a fake coffee shop website that, when fetched by Claude, tricked the agent into spelling out the user's name, employer, and hometown one letter at a time through URL paths. Claude's web_fetch tool is restricted to GET requests. It cannot POST. It cannot write. Paul did not need it to write. The path of a GET request carries information outward. Every link Claude followed was a bit of PII leaving the sandbox.

Anthropic confirmed the issue through HackerOne and patched it by disabling web_fetch link-following on external pages. The specific channel is closed. The structural condition that created it is not.

The covert channel, not the memory

Most commentary has focused on the memory angle: Claude accumulates personal data, and that data leaked. The memory store is the target asset, but it is not the interesting part. The interesting part is the exfiltration channel, because the channel was a feature working as designed.

web_fetch makes GET requests. GET requests have URLs. URLs have paths. Paths are chosen by the agent. The agent's choices are influenced by page content. If the page content says "navigate to /a to continue," and the agent complies, the server learns the agent chose /a. Paul's site served 27 links per page (a-z plus hyphen). Each fetch selects one link. That is log2(27) = 4.75 bits per request. His attack spelled "ayush-paul" (10 characters, 10 fetches after the initial page load) plus company and hometown. Call it 30 characters total, roughly 30 fetches, each carrying one selection from a 27-symbol alphabet. Total channel capacity for the attack: about 143 bits. Enough for a name, an employer, and a city.

The rate limit is whatever web_fetch allows per conversation. Paul's attack completed in one turn. A longer payload (say, a full home address, phone number, and security question answers) would need more fetches but the same mechanism. The channel bandwidth is low. The value per bit is high.

The information flow is: memory store, to agent reasoning, to URL path selection, to HTTP request, to attacker's server log. Every hop is a legitimate operation. No hop violates its own spec. The composition of legitimate operations creates an unauthorized flow. This is a covert channel in the original sense (Lampson, 1973): a communication path that was neither designed nor intended for information transfer.

Twelve months of the same structural condition

Paul's disclosure is the latest in a sequence. Each entry found a different exfiltration path. Each path was patched. Each patch closed one channel without changing the architectural condition that generates channels.

Six disclosures. Six different channels. One pattern: a tool with legitimate outbound reach is repurposed to carry data it was not designed to carry. The question is whether the patch rate can outrun the channel-creation rate. The answer depends on how many tools the agent has. Each new integration (MCP servers, Google Drive, email) adds shared resources between the agent and the outside world. Each shared resource is a candidate covert channel. Patches are linear (one per disclosure). Candidate channels grow combinatorially with the number of tools.

The nth-order reading

Under the Bilar (2009) nth-order taxonomy, the Memory Heist is a 3rd-order attack. Count trust-boundary crossings from attacker entry to target asset:

The attacker controls content at Hop 3. That content functions as instructions to the agent at Hop 1, which acts on the memory store at Hop 0. The covert channel runs through Hop 2 in both directions: inward (page content influences agent behavior) and outward (agent behavior encodes data in URL paths).

The earlier attacks in the table follow the same geometry. Rehberger's Files API exploit is 3rd-order: poisoned document at Hop 3, code sandbox at Hop 2, Files API call at Hop 1, chat history at Hop 0. CVE-2026-54316 substitutes a pre-approved domain for the link-following mechanism but keeps the same hop count.

Two structural failures

Map Paul's attack onto the Emergent Insecurity framework. Two of the four structural failures fit cleanly. The other two apply to the memory system and the disclosure timeline but not to the channel itself, and I will not force them.

Semantic Gap. The web_fetch spec verified the HTTP method (GET only, no POST). The property that mattered was information flow direction in URL paths, which the spec did not address. Verified the wrong property. Missed the right one. This is the core of the attack. A covert channel exists precisely where the security model's abstraction diverges from the system's actual information-carrying capacity. "Read-only" described the method. It did not describe the flow.

Paul's attack also widens the semantic gap on the data side. Claude inferred Paul's hometown ("Charlotte") from the name of a high school hackathon, a fact Paul never stated directly. The gap between what the user believes is stored and what the agent can reconstruct through inference is itself unverified. The user's mental model of "what Claude knows about me" is narrower than the agent's actual reach.

Trusted Process Subversion. Link-following was a navigation feature. Its purpose was to let Claude browse multi-page sites, a legitimate workflow. Paul repurposed it as a data transmission protocol by controlling the link targets. The process was trusted because it served a real purpose, not because anyone verified what it could carry. Anthropic's patch (removing link-following on external pages) revokes the trust. It does not address the general pattern: any tool feature that involves agent-selected outputs observable by an external party is a candidate for the same subversion.

What Willison named and what it does not cover

Simon Willison's Lethal Trifecta (June 2025) identifies the three conditions: private data access, exposure to untrusted content, and an exfiltration vector. If all three are present, the system is structurally vulnerable. The Memory Heist is a textbook instance: Claude has memory (private data), Claude fetches attacker-controlled pages (untrusted content), Claude's URL path choices leak information outward (exfiltration vector).

The Trifecta names the condition but stops there. It is a risk-identification checklist, not an engineering guide: it tells you that you are exposed, not which boundary failed or what to verify. The nth-order taxonomy adds the geometry: how many trust boundaries separate the attacker from the target, and which boundary owner failed to verify what. The Emergent Insecurity framework adds the why: the gap between what was verified (HTTP method) and what needed verification (channel capacity of URL paths) is structural. It recurs because the same failure modes generate new channels faster than point patches close old ones.

What follows for users

Audit your memory. Claude's memory summaries are viewable in Settings. Read them. Delete anything you would not want an attacker to reach. The memory system has no access control within a session: if Claude knows it, any tool interaction can touch it.

Treat every URL you give Claude as granting the site's author influence over Claude's behavior. Paul's site served different content to Claude's user-agent than to browsers. You cannot verify what Claude saw by visiting the same page.

What follows for builders

The structural fix is to break the composition that creates the channel. If the agent has private data and outbound tool access, proxy all outbound requests through a gateway that normalizes request structure (fixed-length paths, no agent-selected URL components). This eliminates the path-as-keyboard mechanism at a real cost: the agent cannot browse paginated sites, follow documentation links, or navigate any multi-page resource. A middle path is per-session user-approved domains: link-following allowed only on domains the user explicitly names in that conversation, blocked everywhere else. The cost is one extra confirmation step. The gain is that attacker-controlled sites cannot trigger link-following at all unless the user specifically sends the agent there.

Failing that, instrument. Paul's attack required roughly 30 sequential web_fetch calls to the same domain, each to a path exactly one character longer than the last. A detector watching for monotonically increasing path length on sequential same-domain fetches would have flagged this before the name was fully spelled. The detector has an obvious false-positive problem: paginated documentation and sequential blog posts produce similar patterns. Tightening helps. Require path-length increase combined with single-character alphabet-constrained extensions and a fetch rate faster than the conversation's normal browsing rhythm. That three-signal conjunction is cheap to check and unlikely to match legitimate navigation. The question is whether any shipping agent platform checks it. As of this writing, the answer appears to be no.

The deeper question is whether the covert channel problem is solvable at the tool level at all. Lampson's 1973 formulation defines covert channels as arising from any shared resource between a sender and a receiver. In an agent system, the shared resources include: URL paths, request timing, request ordering, which tool is called, how many times it is called, and what the agent says in its visible response. Closing URL paths as a channel does not close timing. Closing timing does not close ordering. The full enumeration is the work that agent security has not yet done. Until it is done, every patch is a game of whack-a-mole against a list of channels nobody has written down.

The channels are emergent. The enumeration is incomplete. The patches continue.

Sources: Ayush Paul, "The Memory Heist," July 9, 2026. Simon Willison, "The lethal trifecta for AI agents," June 16, 2025. Johann Rehberger, Embrace The Red, October 2025. Oasis Security, "Claudy Day," January/March 2026. Check Point Research, CVE-2025-59536 / CVE-2026-21852, February 2026. CVE-2026-54316 (advisory published via GitLab Advisory Database, June 2026; the vulnerability is in Claude Code, not GitLab). Lampson, "A Note on the Confinement Problem," CACM 16(10), 1973. Bilar, "nth-Order Subversion Attacks," NATO CCDCOE, 2009. Bilar, "Emergent Insecurity," arXiv:2509.11173, 2025.

Cross-references: JADEPUFFER and the Verification Bottleneck, Mini Shai-Hulud, Access-as-a-Service.

AI-assisted drafting (Claude Opus 4.6). All claims checked and final text approved by the author.