# Base64-Encoded Path Segment in a WebFetch URL to a Pre-Approved Trusted Domain (Covert Exfiltration Channel)

- **Severity:** High
- **Signature ID:** `dd40c73f-b5d8-42be-b335-995cef298d70`
- **CVEs:** CVE-2026-54316
- **MITRE ATLAS:** AML.T0057 (LLM Data Leakage)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), LLM02 (Sensitive Information Disclosure)

## Summary

AI coding agents like Claude Code let a fetch tool auto-approve requests to certain 'trusted' domains such as huggingface.co without asking permission. Attackers abuse this by hiding stolen data inside the URL path as base64 text, then having the agent 'fetch' that URL — the trusted domain silently logs the request as a download, giving the attacker a covert channel to smuggle out files, environment variables, or command output.

## How the attack works

An attacker first gets malicious instructions into the agent's context, for example through a poisoned document or tool output the agent reads. Those instructions tell the agent to build a WebFetch URL to a domain that's pre-approved as safe, such as huggingface.co, but with the sensitive data encoded as base64 in the path (e.g. inside a fake repository file path). Because the hostname is allowlisted, the agent issues the request without any confirmation prompt or blocking. The trusted service processes the path as a normal file resolution, and the act of that resolution (or the path itself, visible to anyone monitoring traffic to attacker-controlled repositories) becomes the exfiltration event — no direct connection to attacker infrastructure is needed.

## Why it matters

An organization can lose confidential files, credentials, environment variables, or command output through what looks like ordinary traffic to a reputable, allowlisted service, bypassing the tool restrictions meant to prevent unauthorized data egress.

## What you can do

- Avoid pre-approving entire domains as bare hostnames for agent fetch tools; scope allowlists to specific paths or repositories where possible.
- Review agent fetch logs for URLs containing long base64-padded segments (strings ending in '=' or '==') in the path, especially to model/dataset hosting domains.
- Treat any agent-generated URL where the path looks encoded or unusually long as suspicious, even if the domain is trusted.
- Restrict what untrusted content (documents, tool outputs) an agent can read before it is allowed to make outbound fetch requests.

## Known benign look-alikes

- An ordinary WebFetch/download URL to a real HuggingFace model or dataset repository, e.g. https://huggingface.co/bert-base-uncased/resolve/main/config.json -- model/file names are short hyphenated slugs, not a 16+ character base64-padded blob
- A URL containing a long hex-only commit SHA (e.g. a 40-character git hash) -- excluded because hex-only digits never include the '=' base64 padding character this rule requires
- Documentation discussing HuggingFace model hosting or the WebFetch tool's domain allowlist without any encoding/exfiltration framing
- Ordinary technical prose that merely co-mentions huggingface.co and base64/encode in the same sentence with no fetch/request-action framing -- e.g. 'For private models on huggingface.co you must base64 encode your username and access token for the Basic Auth header' (describing HTTP Basic Auth, not exfiltration) or 'huggingface.co uses git-lfs... you may need to base64 encode binary diffs when debugging LFS pointer files' -- condition 2 now requires a fetch/request-action cue near the domain, which these documentation sentences lack

## References

- https://agentthreatrule.org/en/rules/ATR-2026-02304
- https://github.com/anthropics/claude-code/security/advisories/GHSA-fg94-h982-f3mm
- https://nvd.nist.gov/vuln/detail/CVE-2026-54316

---
Source: https://www.netzilo.com/threats/atr-base64-encoded-path-segment-in-a-webfetch-url-to-a-pre-appro