Oasis Discloses Claude Desktop Prompt Injection Flaw
On July 15, 2026, Oasis Security disclosed PromptFiction, a Claude Desktop flaw that let crafted claude:// links automatically submit attacker-authored prompts with a single click. Dark Reading reported that Anthropic fixed it in version 1.1.2321. Oasis said combining the flaw with other Claude vulnerabilities could have enabled local-file access, conversation-history exfiltration, persistence, and remote code execution.
Oasis Security disclosed PromptFiction, a vulnerability in Anthropic's Claude Desktop application that used crafted claude:// links to submit attacker-authored prompts after a victim clicked a link. According to Dark Reading, the issue has been fixed in Claude Desktop version 1.1.2321.
The vulnerability affected Claude Desktop's handling of its custom URI scheme. Oasis researcher Elad Luz wrote that a crafted link could open the desktop application and submit a prepared prompt without requiring the user to press Enter or Send. Dark Reading reported that this removed the normal opportunity for a user to review the prompt before it reached the AI agent.
Potential attack chain
The standalone link-based behavior could expose users to unauthorized agent instructions. Reporting indexed by IT Security News states that PromptFiction could allow hidden prompts, local-file access, conversation-history exfiltration, or code execution from a single malicious link.
Dark Reading reported that the more serious outcomes depended on combining PromptFiction with a separate set of Claude flaws previously identified by Oasis. Luz wrote that, when Anthropic's official Filesystem Server was installed, the combined attack path could enable read/write access to local files, persistence, and ultimately remote code execution.
The affected URI scheme broadens the delivery surface beyond a conventional web prompt. According to Oasis' account as reported by Dark Reading, an attacker could place a malicious link in a browser page, chat message, document, or search result, relying on a single click to deliver instructions to the desktop agent.
Implications for AI agent security
The patch reduces exposure for users running version 1.1.2321 or later, according to Dark Reading. Teams using desktop AI assistants should verify deployed versions and review whether custom URI handlers can invoke agent actions without an explicit confirmation step.
This incident illustrates that deep links, local tool connectors, and file-system integrations can create additional paths through which untrusted content reaches an agent with access to user data or local capabilities. For ML and security teams, the relevant control boundary is therefore the full chain from link activation to tool execution, not only the model's text input.
Key Points
- 1PromptFiction used a crafted claude:// link to submit an attacker prompt without a user reviewing or sending it.
- 2Dark Reading reports Anthropic fixed the flaw in Claude Desktop 1.1.2321, making version verification the immediate mitigation.
- 3Deep links and tool connectors can extend prompt-injection risk beyond ordinary chat input.
Scoring Rationale
The vulnerability concerns a desktop AI agent's ability to receive attacker-controlled instructions through a one-click URI handler, with serious impact possible in a chained exploit. It is particularly relevant to practitioners deploying agents with local file or tool access, although a reported patch limits ongoing exposure.
Sources
Public references used for this report.
Practice interview problems based on real data
1,625 SQL & Python problems across 15 industry datasets — the exact type of data you work with.
Try 250 free problems
