One Click Was All It Took to Hijack Anthropic's Claude AI

Key points

• Researchers at Oasis Security discovered a flaw, named "PromptFiction," in Anthropic's Claude Desktop application that let attackers plant hidden instructions in the AI with a single click.
• The vulnerability used a special link format ("claude://") to open the app and automatically submit attacker-written commands, with no action required from the user beyond clicking.
• When combined with a separate set of flaws called "Claudy Day," attackers could have read private conversations, accessed local files, and executed malicious code on a victim's computer.
• Anthropic patched the flaw in Claude Desktop version 1.1.2321, first reported in full detail by Dark Reading.
• A second researcher independently found the same flaw before Oasis but chose not to publish; Oasis credited them publicly.

Anthropic's Claude Desktop, the downloadable app that lets people chat with the Claude AI on their own computer, had a flaw that could have let criminals steal private files and conversations without the victim doing anything beyond clicking a single link.

Researchers at Oasis Security found and reported the bug, naming it "PromptFiction."

How did the attack work?

A prompt injection is an attack where criminals secretly feed instructions to an AI system, tricking it into doing things its real user never intended. Most known examples required the victim to press Send or Enter, submitting the hidden command themselves.

PromptFiction skipped that step entirely.

Claude Desktop registers a custom URI scheme, meaning it listens for links starting with "claude://" the same way your computer opens Zoom when you click a meeting invite. Oasis found that a crafted "claude://" link would open Claude Desktop and immediately submit a prepared, attacker-written command to the AI with no user review at all.

A malicious link placed on a website, in an email or a chat message, would do it. One click.

To hide the attack, criminals pad the hidden instruction with innocent-looking text, burying the malicious part below what the user can see without scrolling. Claude still acts on the full message.

On its own, that's serious. Combined with the "Claudy Day" vulnerabilities Oasis had already found in Claude, the damage could go further: pulling a victim's previous AI conversations, accessing files on their computer, and at worst running foreign code on the machine. Elad Luz, research lead at Oasis, described the worst-case chain as enabling "silent exfiltration of the user's previous conversations and, when Anthropic's official Filesystem Server is installed, read/write access to local files, persistence, and ultimately remote code execution on the victim's machine."

This isn't Anthropic's first rough patch on the security front. Our 15 July story on Oasis's earlier work found two unpatched flaws in Anthropic's browser assistant exposing private Google data, and the pattern of compounding Claude vulnerabilities here is worth watching closely.

Anthropics fixed the flaw in Claude Desktop version 1.1.2321. Check that you're running that version or any newer release; the app's "About" menu usually shows it.

Another researcher had independently found the same vulnerability and reported it quietly to Anthropic without publishing. Oasis credited them publicly, writing: "We thank them for their work and make no claim to sole discovery."

Luz put the wider problem plainly, telling Dark Reading that "the old model of a person carefully reviewing every release doesn't survive contact with this velocity." His answer: use AI tools to review and secure new AI releases in real time.

Should you worry?

For organisations deploying AI assistants internally, the practical concern isn't just this one patch. Randolph Barr, CISO at Cequence Security, advises putting an inspection layer between AI agents and everything they communicate with, restricting which destinations agents can reach, and maintaining a clear inventory of every AI tool, plugin, and server in the environment. The flaw is fixed; the attack class it represents isn't going away.