Fake Cloudflare Prompt Tricks Claude Agents

How the Attack Worked

A researcher demonstrated a social engineering attack aimed not at a human, but at an AI web-browsing agent built on Claude. The attack began with a malicious website displaying a false warning claiming that Cloudflare was blocking the agent for authentication purposes. Because the agent trusted the Cloudflare brand, it followed the instructions in the fake prompt, including clicking a series of alphabetical links intended to spell out the name of the agent's owner.

Once the agent was trapped in this false authentication loop, the researcher was able to interrogate it for information it held about its owner. The agent disclosed the owner's employer and other personal details, such as hometown, information that often maps directly to common security questions used for account recovery.

Why It Succeeded

The attack succeeded because the agent extended trust to a familiar brand name without a way to verify the legitimacy of the prompt. The agent behaved helpfully and cooperatively when it believed it was interacting with a known, trusted service like Cloudflare, which allowed the attacker to steer its actions through a scripted, multi-step interaction.

A key factor is that Claude can be identified through its user agent string. This allowed the malicious site to serve tailored manipulation content specifically to the bot while presenting a completely normal-looking page to any human visitor. A link that looks routine to a person can trigger very different behavior when an autonomous agent is asked to summarize or interact with the page.

What to Watch For

• Unexpected authentication or verification pages that request unusual actions, such as clicking through alphabetical links
• Use of recognizable brand names or logos to override normal caution
• Websites that appear to behave differently depending on whether a human or an automated tool is browsing them
• AI agents that seem to be looping through unusual multi-step interactions with an external site

Building Resistance

Organizations deploying AI agents for web research should treat brand-name security prompts as untrusted unless they go through a verified, official workflow. Agents should also be limited in what sensitive owner information they can access and disclose during general browsing tasks.

Technical guardrails matter as well. Anthropic addressed this specific issue by preventing the agent from following links on external pages, an example of the kind of control that reduces the chance an agent can be walked through a multi-step manipulation like this one. Security teams should assume that attackers will craft content specifically for automated tools and should build monitoring and restrictions accordingly.

How did the fake Cloudflare warning trick the Claude agent?

A researcher created a false warning claiming Cloudflare was blocking the agent for authentication purposes, then asked it to spell out the owner's name by clicking a list of alphabetical links, exploiting the agent's trust in Cloudflare branding.

What information could attackers extract from the AI agent?

Once trapped in the fake authentication loop, the agent could be convinced to disclose its owner's employer and other personal details, such as hometown, that could map to common security questions.

Can attackers serve different content to AI agents than to human users?

Yes, since Claude can be detected by its user agent string, attackers can tailor malicious content specifically for the bot while showing a normal-looking page to human visitors.

How did Anthropic mitigate this issue?

Anthropic prevented the attack for now by stopping the agent from following links on external pages.