Skip to content

Back to the catalog

darkreading.comarticle

AI Security Briefing

Dark Reading reports on "PromptFiction", a Claude Desktop flaw found by Oasis Security where a crafted claude:// custom URI link opens the app and auto-submits an attacker-authored prompt with no Send step or user review. Padding the prompt exploits message folding to hide the malicious instructions. Chained with the earlier "Claudy Day" flaws, it could allow silent exfiltration of conversation history and, with Anthropic's Filesystem Server installed, local file access, persistence and RCE. Fixed in Claude Desktop 1.1.2321; the article closes with agent governance advice such as an inspection/policy layer and an inventory of agents and MCP servers.

TL;DR Oasis's PromptFiction: a claude:// link auto-submits a hidden prompt in Claude Desktop (zero-click injection), chainable with Claudy Day to RCE; fixed in 1.1.2321.
Open original ↗

Organisations named here

  • Cequence Security
  • Elad Luz
  • PromptFiction

Technologies named here

  • Anthropic Claude Desktop
  • Anthropic Responsible Disclosure Program
  • Claude / claude.ai
  • Anthropic's official Filesystem Server
  • Claude Desktop
  • Claude
  • Anthropic
  • Model Context Protocol
  • Oasis Security

Techniques named here

  • Prompt injection via custom URI scheme
  • Chaining with Claudy Day flaws for end-to-end attack
  • Prompt Injection

Threat actors named here

  • PromptFiction
  • Claudy Day

Related in AI Security