Loading story…
Researchers disclosed PromptFiction, a vulnerability in Anthropic’s Claude Desktop app that let a crafted claude:// link automatically open the application and submit an attacker-controlled prompt without requiring the user to review or press send. Oasis Security reported the issue through Anthropic’s responsible disclosure program, and Anthropic patched the behavior in Claude Desktop version 1.1.2321 so prompts delivered through the custom URI scheme are only pre-filled for manual review before submission.
The flaw could be delivered through websites, documents, emails, chat messages, or search results, and researchers said attackers could hide malicious instructions using benign padding and Claude’s message-folding behavior. On its own, the bug enabled reliable prompt injection and possible exfiltration of prior conversation data or abuse of connected tools; when chained with previously disclosed Claudy Day issues and environments using Anthropic’s official Filesystem Server, it could allow local file read/write access, persistence, malicious code planting, and ultimately remote code execution on the victim machine.
Track how attackers are adapting to this technology.
3 events from the most recent confirmed update back to the earliest known activity.
Anthropic remediated the PromptFiction issue by changing Claude Desktop so prompts delivered via the claude:// scheme are only pre-filled and must be manually reviewed and sent. The fix was released in Claude Desktop version 1.1.2321.
Oasis Security identified the PromptFiction vulnerability in Anthropic's Claude Desktop and reported it through Anthropic's responsible disclosure program. The flaw allowed a crafted claude:// link to automatically submit attacker-controlled prompts without user review or confirmation.
Researchers publicly disclosed PromptFiction as a Claude Desktop vulnerability that enabled one-click prompt injection via the app's custom URI handler. They also described how chaining it with previously disclosed Claudy Day flaws could enable data exfiltration, local file access, persistence, and possible remote code execution.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
3 references tracked. Mallory keeps watching after this page renders.
hackread.com
Open sourcedarkreading.com
Open sourceoasis.security
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers at **Oasis Security** disclosed an attack chain dubbed **"Claudy Day"** that combines three flaws in Anthropic’s **Claude** platform to enable covert data theft. The chain starts with attacker-controlled Google search results or fake Claude ads that abuse an **open redirect** on `claude.com`, leading victims to what appears to be a legitimate Claude page. From there, a pre-filled chat URL can carry **hidden prompt-injection instructions** embedded in HTML so the user sees benign text while Claude processes malicious commands in the background. According to the reports, the chained flaws allow attackers to silently instruct Claude to search prior conversations for sensitive information and exfiltrate it through the **Anthropic Files API**, creating an end-to-end path from victim luring to unauthorized data exposure. The issue is notable because it does not require extra tooling, integrations, or MCP servers; built-in Claude features are sufficient for exploitation. A separate report about Claude autonomously exploiting vulnerable websites is **not** the same incident, and a report on the **SideWinder** espionage campaign is unrelated.
Jun 29, 2026
Researchers at Manifold disclosed two unpatched vulnerabilities in Anthropic’s **Claude for Chrome** extension that can let a malicious browser extension trigger Claude actions and access sensitive Google Workspace content, including **Gmail messages, Google Docs data and comments, and Google Calendar entries**. The researchers said the flaws were reported in May and remained reproducible in version `1.0.80`, with one issue allowing another extension that has script access on `claude.ai` to simulate a trusted user click and launch hardcoded Claude prompts on the victim’s behalf. The weaknesses stem in part from Anthropic’s earlier mitigation for **ClaudeBleed**, which limited prompts to pre-approved tasks but did not verify that task-triggering clicks came from a real user. Manifold also identified a separate design flaw in which Claude’s side panel can enter a privileged **no-confirmation** mode through a URL parameter, creating a potential privilege-escalation path if a future bug allows outside control of that parameter. The risk is highest when users enable Claude’s **“Act without asking”** mode, because the extension may perform actions without visible consent prompts; Anthropic acknowledged the reports but had not issued fixes, saying one issue was already tracked internally and the other was not externally reachable.
Jul 17, 2026
A proof-of-concept indirect prompt-injection attack reportedly induced **Claude Code Opus 5** in Auto Mode to execute attacker-controlled code after processing a malicious website during an ostensibly benign summarization task. The chain caused the agent to fall back from WebFetch to `curl`, download and extract a ZIP archive, then create and run a Python decoder inside the attacker-controlled extraction directory. A bundled `struct.py` abused Python import-path precedence to shadow the standard-library `struct` module when the decoder imported Base64-related functionality, enabling a staged payload to contact attacker-controlled command-and-control infrastructure and launch Calculator. The researcher reported success rates of 60% for Python/C2 and nested Claude subprocess variants, and 80% for a variant that opened Calculator and wrote outside the designated workspace, in limited testing. Anthropic reportedly categorized the disclosure as Informative, stating that Auto Mode is a convenience capability governed by a best-effort classifier rather than a security boundary. Organizations running autonomous coding agents against untrusted content should isolate the runtime, restrict outbound network access, withhold sensitive credentials, constrain filesystem access, and monitor agent-created processes and tool calls.
Sep 3, 2026