A vulnerability in Claude Desktop allowed a crafted link to automatically send attacker-written instructions to the AI agent without the user pressing Send or reviewing the full prompt first. The flaw, named PromptFiction by Oasis Security, affected how Claude Desktop handled the custom claude:// URL scheme. Anthropic has since fixed the issue, and Oasis says users should update Claude Desktop to version 1.1.2321 or later.
What Happened
Claude Desktop can be opened through special links, similar to how a Zoom link opens Zoom or a mail link opens an email client. Oasis found that a maliciously crafted claude:// link could do more than open the app: it could carry a full prompt and cause Claude Desktop to submit it automatically. That removed the normal moment where a user would read the prompt and decide whether to send it.
In simple terms, the user only had to click a link. After that, the prompt was already inside Claude and already submitted. The attacker’s instructions could be hidden beneath harmless-looking text, using Claude’s message-folding behavior so the visible part looked innocent while the real payload sat out of view.
Why PromptFiction Matters
PromptFiction is important because it changes the normal prompt-injection model. Classic prompt injection usually requires malicious instructions to be placed inside content the AI reads, such as a webpage, email, document, or chat message. Here, the attack used a desktop application link as the delivery mechanism, automatically placing the attacker’s instructions directly in front of the agent.
That makes the issue especially dangerous for AI agents. The agent does not know whether the prompt came from the user intentionally or from a malicious link. It simply receives instructions and acts based on the access it already has. As Oasis put it, the failure was upstream: the system allowed a prompt to reach the agent without proof that a human had written it or approved it.
What an Attacker Could Do
The impact depended on what Claude Desktop could access in the user’s environment. On a standard setup, Oasis said the attack could target previous conversation history, which may contain source code, internal documents, customer data, plans, or sensitive technical details.
In more powerful configurations, the risk could go further. Dark Reading reported that, when combined with earlier Claude-related flaws known as Claudy Day, the issue could support silent exfiltration of previous conversations and, where Anthropic’s official Filesystem Server was installed, read/write file access, persistence, and potential remote code execution on the victim’s machine.
This is the key lesson: the vulnerability was not dangerous only because of the link. It was dangerous because AI agents increasingly have access to useful, sensitive, and sometimes executable capabilities.
How the Attack Flow Worked
A PromptFiction attack could begin with a malicious link delivered through a website, email, document, chat message, or search result. The link used Claude Desktop’s custom claude:// URL scheme to open the application and submit an attacker-crafted prompt automatically.
To reduce suspicion, the prompt could begin with harmless-looking text. The malicious part could be padded below the visible section, meaning the user might only see something ordinary unless they expanded the full message. Once submitted, Claude would process the full prompt, including the hidden instructions.
Why Custom URL Schemes Are Risky
Custom URL schemes are convenient, but they are also a known desktop security risk. They allow websites, documents, and other apps to launch local desktop applications with parameters. If the receiving application trusts those parameters too much, a simple link can become an input channel for attacker-controlled commands.
In the case of Claude Desktop, the risk was amplified because the receiving application was not just opening a screen. It was sending instructions to an AI agent. That turns a desktop deeplink issue into an agentic AI security issue.
Anthropic’s Fix
Oasis reported the vulnerability to Anthropic through its Responsible Disclosure Program. The flaw has been fixed in Claude Desktop version 1.1.2321. After the fix, prompts delivered through these links no longer execute automatically; they wait pre-filled so the user can review them and manually press send.
That change restores the human approval step. It does not remove every prompt-injection risk, but it closes the specific path where one click could submit attacker-controlled instructions without review.
Why This Is Bigger Than One Bug
PromptFiction is another example of a broader problem in AI agent security: agents are being connected to more tools, more data, and more local capabilities faster than the surrounding security model is maturing.
A traditional chatbot mostly generates text. An AI agent can read files, browse websites, call APIs, use connectors, interact with code, and sometimes write to local systems. That means the security question is no longer only “What did the model say?” It is also “What can the agent reach, and who approved this action?”
As AI agents become more capable, every input channel matters: links, documents, emails, browser pages, plugins, MCP servers, file systems, and API connectors.
What Users Should Do
Users of Claude Desktop should update to the latest version, specifically 1.1.2321 or later, according to Oasis. They should also treat links that open AI apps with the same caution as links that download files or launch desktop software.
Users should be especially careful with links that open local applications from emails, chats, websites, documents, or search results. If an AI app opens unexpectedly with a pre-filled prompt, the safest response is to stop and inspect the full prompt before taking action.
What Organizations Should Learn
For companies deploying AI agents, the lesson is not just to patch Claude Desktop. The larger issue is governance around agent access and agent actions.
Security teams should ask:
- Which channels can send instructions to our agents?
- Can we distinguish user-approved prompts from prompts delivered by a link or external system?
- What files, APIs, tools, and conversations can each agent access?
- Do agents need standing access, or should access be granted only per task?
- Are agent actions logged and reviewable?
- Can risky actions be blocked until a human approves the exact step?
Final Thoughts
PromptFiction shows that AI agent security is no longer only about blocking bad prompts inside chat windows.
A single desktop link was enough to deliver instructions directly to an AI agent and bypass the normal user review step. In stronger configurations, that kind of flaw could move from data exposure toward file access or code execution.
AI agents need stronger boundaries around where instructions come from, what they can access, and what requires explicit human approval.
As AI tools become more agentic, every link, connector, plugin, and protocol handler becomes part of the attack surface.
