Still, this is a vuln in what I imagine is their most frequently used path:

Attacker provides link to website, their software crawls the website, and during the crawl there should not happen security issues as fundamental as this.

It's baffling that the Website crawler can make 50 changes to the URL in a query that tries to compare several public entities and on top of this manages to leak user secrets.

To me this shows a striking lack of defense-in-depth thinking:

   - why is single URL crawl with 20+ redirects not flagged as problematic and/or aborted?

   - why is a query about a coffee place based on its public URL even seeded with the users' context and confidential information? 

   - why dont they just look up the coffee place on a trusted source like google maps and continue from there?

   - why is the basic "social" engineering style attack working?

   - why is the cloudflare impersonation not challenged if the website is clearly not from cloudflare and there are zero references from cloudflare to this website in the training corpus?

I know there are fundamental reasons in the LLM technology why this kind of attack is possible, but there should be so many more checks around web crawling in Claude.

How can security engineers at Anthropic say they know about this kind of vulnerability but have not implemented any of these defense in depth mitigations for it? Is everybody out shopping for a new yacht?