researcher<\/a>s who discovered it. \u201cCombined with the building blocks we documented in Claudy Day, it becomes an end-to-end attack: Silent exfiltration of the user\u2019s previous conversations and, when Anthropic\u2019s official Filesystem Server is installed, read\/write access to local files, persistence, and ultimately remote code execution on the victim\u2019s machine.\u201d<\/p>\nSince the prompt is dispatched to the agent automatically, the researchers say, the human is removed from the loop, a \u201cdeliberately simple\u201d idea. \u201cThe danger is not novelty,\u201d they wrote. \u201cIt is the collapse of the one assumption that made URL-borne prompts tolerable: That a person would see and approve the prompt before it ran.\u201d<\/p>\n
In the \u201cbig picture: This worked the way responsible disclosure is supposed to. Oasis reported the flaw privately, Anthropic patched it, and the fix shipped before disclosure,\u201d says Randolph Barr, CISO at Cequence Security.\u00a0<\/p>\n
\u201cThe report-to-patch timeline isn\u2019t spelled out, but from what I\u2019m seeing, Anthropic moved quickly and handled this the way a vendor should,\u201d says Barr.<\/p>\n
It could have been much worse if the vulnerability had gone undetected. Bad actors could easily hide the payload. \u201cThe folding trick Auto-submission means the prompt does appear in the conversation after it is sent, so a careful user could, in principle, scroll up and notice it,\u201d the researchers say. \u201cWe blunt that by exploiting the chat UI s message-bubble folding: A prompt that is long enough is collapsed, showing only its opening lines behind a \u2018show more\u2019 control.\u201d<\/p>\n
By padding the visible portion with a benign request and a run of encoded newlines (%0d%0a), the researchers say, \u201cthe attacker pushes the malicious instructions below the fold. The user sees a harmless opening; the agent receives the whole thing.\u201d<\/p>\n
From there, a would-be attacker could gain access to and exfiltrate conversations and even perhaps code execution.<\/p>\n
\u201cWhat made the flaw notable is that one click on a crafted claude:\/\/ link could auto-submit instructions to Claude Desktop, no send button, no chance to review,\u201d says Barr. \u201cAnd if the user had the popular Filesystem MCP Server installed, it escalated from data exposure to potential code execution on the victim\u2019s machine.\u201d<\/p>\n
While this time around \u201cOasis Security found this first, and that\u2019s the good outcome,\u201d Barr says, \u201cthe uncomfortable truth is there\u2019s no guarantee a researcher gets there before a bad actor does, and AI is compressing that race.\u201d Since the \u201cwindow between a vulnerability existing and a patch shipping is exactly where organizations are most exposed,\u201d he says, \u201cyou can\u2019t patch your way out of a zero-day. You need controls that buy you time.\u201d<\/p>\n
Good cyber hygiene\u2014the basics\u2014is key. Threat actors increasingly are \u201cusing many and diverse methods to hide malicious payloads, such as the \u2018folding trick\u2019 mentioned here or other types of multi-stage or polymorphic encoding,\u201d notes Viakoo Vice President John Gallagher. \u201cThat\u2019s why the focus needs to be on cyber hygiene and specifically autonomous remediation, so that dormant malware has a limited (or non-existent) space to operate within or to execute remote code on the device.\u201d\u00a0<\/p>\n
Gallagher urges organizations to view \u201cAI agents as another form of \u2018shadow IT,\u2019 similar to operational technology (OT) and IoT devices that are operated outside of IT.\u201d \u00a0<\/p>\n
\u201cNot only do these agents often have privileges but they also can enable lateral movement into corporate networks and storage systems,\u201d he says. \u00a0<\/p>\n
Governance must be prioritized, but in most organizations hasn\u2019t caught up this early on. \u201cGovernance is clearly lacking in this area,\u201d says Gallagher, as non-human identity management \u201cis in its early stages, and this is an example of AI getting ahead of the proper controls around it.\u201d \u00a0<\/p>\n
Internal governance should be \u201cin place before allowing AI Agents to use protocols like MCP (Model Content Protocol) to interoperate across systems,\u201d says Gallagher. \u00a0\u201cAny protocol that enables AI to read data, run code, or access databases should be thoroughly reviewed and governed before it is implemented.\u201d\u00a0<\/p>\n
Barr agrees, explaining that security teams \u201cshould focus: Put an inspection and policy layer between AI agents and everything they talk to.\u201d In practice, he notes, \u201cthat means monitoring and governing agent API traffic so an agent quietly uploading conversation history to an unfamiliar account gets flagged or blocked; restricting which destinations and API keys agents can use so exfiltration paths are cut off by policy rather than luck; detecting anomalous agent behavior, a desktop assistant suddenly writing to shell config files or opening connect-back channels is not normal; and maintaining an inventory of which agents, MCP servers, and plugins are actually running in the environment. None of that requires knowing about a specific CVE in advance.\u201d\u00a0<\/p>\n
That\u2019s the point, he stresses, \u201cthese controls hold the line during the gap between discovery and patch, whoever discovers it first.\u201d<\/p>\n
Frequently Asked QuestionsHow could attackers hide the malicious prompt?<\/p>\n
Attackers could place a benign request at the beginning of a long prompt and push the malicious instructions below the interface\u2019s collapsed \u201cshow more\u201d section. The user would see the harmless opening while Claude received the complete prompt.<\/p>\n
Has the vulnerability been fixed?<\/p>\n
Yes. Oasis Security privately disclosed the issue to Anthropic, which patched it before the researchers published their findings.<\/p>\n
How should organizations protect AI agents?<\/p>\n
Security teams should inventory deployed agents and MCP servers, inspect agent traffic, restrict approved destinations and credentials, apply least-privilege access and flag unusual behavior such as writing to configuration files or opening unexpected network connections.<\/p>\n","protected":false},"excerpt":{"rendered":"TL;DR \u2014 Key Takeaways PromptFiction allowed a crafted claude:\/\/ link to submit attacker instructions automatically, removing the user\u2019s…\n","protected":false},"author":2,"featured_media":125834,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[8],"tags":[63129,15193,63130,63131,53,3154,63132,63133,182,63134,16187,63135,63136,63137,37471,63138,61911,720,63139,7504,10837],"class_list":["post-125833","post","type-post","status-publish","format-standard","has-post-thumbnail","category-anthropic","tag-agent-access-controls","tag-ai-agent-governance","tag-ai-agent-hijacking","tag-ai-traffic-inspection","tag-anthropic","tag-anthropic-claude","tag-anthropic-security","tag-auto-submitted-prompts","tag-claude","tag-claude-desktop-vulnerability","tag-claude-security","tag-conversation-exfiltration","tag-crafted-claude-links","tag-filesystem-mcp-server","tag-mcp-security","tag-non-human-identity-security","tag-oasis-security","tag-prompt-injection","tag-promptfiction","tag-remote-code-execution","tag-shadow-ai"],"_links":{"self":[{"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/posts\/125833","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/comments?post=125833"}],"version-history":[{"count":0,"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/posts\/125833\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/media\/125834"}],"wp:attachment":[{"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/media?parent=125833"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/categories?post=125833"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/tags?post=125833"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}