Claude.ai Prompt Injection Vulnerability | Oasis Security

What it is

"Claudy Day" — a chain of three flaws in Claude.ai / claude.com disclosed by Oasis Security. The existing summary covers the mechanism; what it doesn't carry is the delivery sophistication and the exposure even in a stock session.

Delivery — why this isn't ordinary phishing

The open redirect (claude.com/redirect/<target>) matters because Google Ads validates ad URLs by hostname only. An attacker buys a search ad that displays a genuine claude.com URL, which silently redirects the clicker to the claude.ai/new?q=... injection URL. The victim never sees a suspicious link — the entry point is a Google search result indistinguishable from the real one, not an email.

Google Ads targeting turns this from spray-and-pray into a precision strike: location, industry, demographics, and — via Customer Match — specific email addresses. A known individual can be served the malicious ad.

What's actually at risk

Even a bare Claude.ai session with no integrations exposes conversation history and memory. Injected instructions can summarize past chats to profile the user, extract chats on a targeted topic (the page names an upcoming merger or a medical concern), or let the agent decide what counts as sensitive and dump it. With MCP servers, tools, or enterprise integrations enabled, the blast radius expands to reading files, sending messages, and hitting any connected API — silently.

What to do

The page's guidance is governance-level, not a patch (the exfil and redirect issues were still being addressed at publication):

• Inventory AI agents/assistants in use, what data they touch, what integrations are enabled — treat shadow AI as a blind spot.
• Audit integrations and permissions. Disable MCP servers, tools, and APIs that aren't actively needed; every reachable service widens the blast radius of one compromised prompt.
• Educate users that pre-filled prompts, shared links, and pasted content can carry hidden instructions — the AI chat box is an attack surface.
• Govern agent identities like human/service accounts: intent analysis, deterministic policy enforcement, just-in-time scoped access, and a full human→agent→action audit trail.

Caveats

Only the prompt-injection flaw was fixed at publication; the exfiltration path and open redirect were still "being addressed," so the delivery and data-egress legs of the chain may not be closed. This is Oasis's second such demonstration (after "OpenClaw"), and the "what to do" section is vendor-framed toward their Agentic Access Management product rather than a concrete detection or config change you can apply directly.