Security researchers at Oasis Security have disclosed a vulnerability in Claude Desktop that could allow attackers to execute hidden prompts, access local files, exfiltrate conversation history, or execute code with a single click on a malicious link.
The vulnerability, dubbed PromptFiction, affects the way Claude Desktop handled claude:// links.
According to the researchers, clicking one of these links caused the application to automatically open, import a prompt from the URL, and immediately submit it without displaying the full prompt or requiring user approval. Anthropic addressed the issue in Claude Desktop version 1.1.2321.
Hidden instructions
Oasis Security demonstrated the attack using what appeared to be an innocuous ASCII art tool.
The visible portion of the prompt looked legitimate, while hidden instructions embedded in the same link were silently processed by Claude Desktop after the user clicked it.
According to the report, the same technique could be used to “plant a hidden prompt, exfiltrate conversation history, read the file system, or execute code.”
The researchers describe the attack as requiring only a single click on what seems to be a trusted link, with no opportunity for the victim to review or approve the hidden instructions before they are executed.
URL scheme becomes an attack vector
The issue stems from Claude Desktop’s registration of the claude:// URL scheme, which allows web links to launch the desktop application.
Rather than simply opening Claude with a draft prompt for the user to inspect, the application automatically submitted the contents of the URL. Oasis Security argues that this behavior effectively turned a URL into an execution mechanism for attacker-controlled instructions.
Patch released
Oasis Security says Anthropic addressed the vulnerability in Claude Desktop version 1.1.2321.
The report recommends that organizations ensure users are running the patched version while also implementing governance around AI agent access, particularly as AI assistants gain access to local systems and sensitive information.
This worked the way responsible disclosure is supposed to
Randolph Barr, Chief Information Security Officer at Cequence Security, says the big picture is that this worked the way responsible disclosure is supposed to. “Oasis reported the flaw privately, Anthropic patched it, and the fix shipped before disclosure. The report-to-patch timeline isn’t spelled out, but from what I’m seeing Anthropic moved quickly and handled this the way a vendor should.
“What made the flaw notable is that one click on a crafted claude:// link could auto-submit instructions to Claude Desktop, no send button, no chance to review. And if the user had the popular Filesystem MCP Server installed, it escalated from data exposure to potential code execution on the victim’s machine.
The immediate action for anyone reading the coverage: verify you’re on Claude Desktop 1.1.2321 or later. Individual users on macOS and Windows get auto-updates by default, so most are already covered. The group that needs to check is managed enterprise environments, if IT deploys via Iru, Intune, Jamf, SCCM, or similar, auto-updates may be disabled and updates rolled out on their own schedule. Verify, don’t assume.”
There’s no guarantee a researcher gets there first
Barr adds that there’s a bigger picture to consider: “Oasis Security found this first, and that’s the good outcome. The uncomfortable truth is there’s no guarantee a researcher gets there before a bad actor does, and AI is compressing that race. The same models that help defenders are helping attackers find and weaponize flaws faster, which means the window between a vulnerability existing and a patch shipping is exactly where organizations are most exposed. You can’t patch your way out of a zero-day. You need controls that buy you time.”
Put an inspection and policy layer between AI agents and everything they talk to
He says that’s where security teams should focus: put an inspection and policy layer between AI agents and everything they talk to. “In practice that means monitoring and governing agent API traffic so an agent quietly uploading conversation history to an unfamiliar account gets flagged or blocked; restricting which destinations and API keys agents can use so exfiltration paths are cut off by policy rather than luck; detecting anomalous agent behavior, a desktop assistant suddenly writing to shell config files or opening connect-back channels is not normal; and maintaining an inventory of which agents, MCP servers, and plugins are actually running in the environment. None of that requires knowing about a specific CVE in advance. That’s the point: these controls hold the line during the gap between discovery and patch, whoever discovers it first.”
Another form of shadow IT
John Gallagher, Vice President at Viakoo, says organisations should see AI agents as another form of “shadow IT”, similar to operational technology (OT) and IoT devices that are operated outside of IT. “Not only do these agents often have privileges but they also can enable lateral movement into corporate networks and storage systems. Governance is clearly lacking in this area. Non-human identity management is in its early stages, and this is an example of AI getting ahead of the proper controls around it.
“Threat actors increasingly are using many and diverse methods to hide malicious payloads, such as the “folding trick” mentioned here or other types of multi-stage or polymorphic encoding. That’s why the focus needs to be on cyber hygiene and specifically autonomous remediation, so that dormant malware has a limited (or non-existent) space to operate within or to execute remote code on the device.”
Gallagher adds that if an AI application is deployed on a workstation that manages OT, critical infrastructure, or physical security software, an RCE on that machine could allow a threat actor to pivot laterally and hijack operational networks. “That’s why “human in the loop” controls are necessary and needed to prevent AI from automatically deploying code that a human should first review.”
Move quickly to autonomous methods of patch management
Organizations need to move (quickly) to autonomous methods of patch management, especially for OT or IoT systems which often lack built-in auto-update capabilities, he advises. “For OT and IoT systems you can’t rely on users to manually click “update.”, leaving many systems behind on firmware patches and therefore vulnerable to AI-driven threats and exploitation.
“Internal governance should be in place before allowing AI Agents to use protocols like MCP (Model Content Protocol) to interoperate across systems. Any protocol that enables AI to read data, run code, or access databases should be thoroughly reviewed and governed before it is implemented.”
Information Security Buzz News Editor
Kirsten Doyle has been in the technology journalism and editing space for nearly 24 years, during which time she has developed a great love for all aspects of technology, as well as words themselves. Her experience spans B2B tech, with a lot of focus on cybersecurity, cloud, enterprise, digital transformation, and data centre. Her specialties are in news, thought leadership, features, white papers, and PR writing, and she is an experienced editor for both print and online publications.
The opinions expressed in this post belong to the individual contributors and do not necessarily reflect the views of Information Security Buzz.