TL;DR — Key Takeaways
PromptFiction allowed a crafted claude:// link to submit attacker instructions automatically, removing the user’s opportunity to review or approve the prompt.
Attackers could disguise malicious instructions beneath a harmless-looking message and potentially steal conversations, access local files or achieve code execution when the Filesystem MCP Server was installed.
Anthropic patched the flaw before disclosure, but organizations still need agent inventories, traffic inspection, least-privilege access and behavioral monitoring to protect against future zero-days.
In a single click, Claude Desktop could be hijacked and coerced to act on an attacker’s instruction—all without giving the user an opportunity to view what they’ve agreed to, according to Oasis Security’s assessment of PromptFiction, a recently discovered vulnerability.
In much the same way as Zoom and email invitations operate, Claude Desktop opens via a special link. But that leaves open the opportunity for a bad actor to provide a version of that link that would skip any kind of review. Instead, the AI agent would act immediately, no review, no send button.
PromptFiction also allows attackers to hide a nefarious payload behind a benign request while only showing users a friendly message.
“On its own, that is a delivery primitive: A single click puts attacker instructions in front of the agent with no send or review afterward,” according to the researchers who discovered it. “Combined with the building blocks we documented in Claudy Day, it becomes an end-to-end attack: Silent exfiltration of the user’s previous conversations and, when Anthropic’s official Filesystem Server is installed, read/write access to local files, persistence, and ultimately remote code execution on the victim’s machine.”
Since the prompt is dispatched to the agent automatically, the researchers say, the human is removed from the loop, a “deliberately simple” idea. “The danger is not novelty,” they wrote. “It is the collapse of the one assumption that made URL-borne prompts tolerable: That a person would see and approve the prompt before it ran.”
In the “big picture: This worked the way responsible disclosure is supposed to. Oasis reported the flaw privately, Anthropic patched it, and the fix shipped before disclosure,” says Randolph Barr, CISO at Cequence Security.
“The report-to-patch timeline isn’t spelled out, but from what I’m seeing, Anthropic moved quickly and handled this the way a vendor should,” says Barr.
It could have been much worse if the vulnerability had gone undetected. Bad actors could easily hide the payload. “The folding trick Auto-submission means the prompt does appear in the conversation after it is sent, so a careful user could, in principle, scroll up and notice it,” the researchers say. “We blunt that by exploiting the chat UI s message-bubble folding: A prompt that is long enough is collapsed, showing only its opening lines behind a ‘show more’ control.”
By padding the visible portion with a benign request and a run of encoded newlines (%0d%0a), the researchers say, “the attacker pushes the malicious instructions below the fold. The user sees a harmless opening; the agent receives the whole thing.”
From there, a would-be attacker could gain access to and exfiltrate conversations and even perhaps code execution.
“What made the flaw notable is that one click on a crafted claude:// link could auto-submit instructions to Claude Desktop, no send button, no chance to review,” says Barr. “And if the user had the popular Filesystem MCP Server installed, it escalated from data exposure to potential code execution on the victim’s machine.”
While this time around “Oasis Security found this first, and that’s the good outcome,” Barr says, “the uncomfortable truth is there’s no guarantee a researcher gets there before a bad actor does, and AI is compressing that race.” Since the “window between a vulnerability existing and a patch shipping is exactly where organizations are most exposed,” he says, “you can’t patch your way out of a zero-day. You need controls that buy you time.”
Good cyber hygiene—the basics—is key. Threat actors increasingly are “using many and diverse methods to hide malicious payloads, such as the ‘folding trick’ mentioned here or other types of multi-stage or polymorphic encoding,” notes Viakoo Vice President John Gallagher. “That’s why the focus needs to be on cyber hygiene and specifically autonomous remediation, so that dormant malware has a limited (or non-existent) space to operate within or to execute remote code on the device.”
Gallagher urges organizations to view “AI agents as another form of ‘shadow IT,’ similar to operational technology (OT) and IoT devices that are operated outside of IT.”
“Not only do these agents often have privileges but they also can enable lateral movement into corporate networks and storage systems,” he says.
Governance must be prioritized, but in most organizations hasn’t caught up this early on. “Governance is clearly lacking in this area,” says Gallagher, as non-human identity management “is in its early stages, and this is an example of AI getting ahead of the proper controls around it.”
Internal governance should be “in place before allowing AI Agents to use protocols like MCP (Model Content Protocol) to interoperate across systems,” says Gallagher. “Any protocol that enables AI to read data, run code, or access databases should be thoroughly reviewed and governed before it is implemented.”
Barr agrees, explaining that security teams “should focus: Put an inspection and policy layer between AI agents and everything they talk to.” In practice, he notes, “that means monitoring and governing agent API traffic so an agent quietly uploading conversation history to an unfamiliar account gets flagged or blocked; restricting which destinations and API keys agents can use so exfiltration paths are cut off by policy rather than luck; detecting anomalous agent behavior, a desktop assistant suddenly writing to shell config files or opening connect-back channels is not normal; and maintaining an inventory of which agents, MCP servers, and plugins are actually running in the environment. None of that requires knowing about a specific CVE in advance.”
That’s the point, he stresses, “these controls hold the line during the gap between discovery and patch, whoever discovers it first.”
Frequently Asked QuestionsHow could attackers hide the malicious prompt?
Attackers could place a benign request at the beginning of a long prompt and push the malicious instructions below the interface’s collapsed “show more” section. The user would see the harmless opening while Claude received the complete prompt.
Has the vulnerability been fixed?
Yes. Oasis Security privately disclosed the issue to Anthropic, which patched it before the researchers published their findings.
How should organizations protect AI agents?
Security teams should inventory deployed agents and MCP servers, inspect agent traffic, restrict approved destinations and credentials, apply least-privilege access and flag unusual behavior such as writing to configuration files or opening unexpected network connections.