Oasis Security discloses PromptFiction: one click on a claude:// link auto-submitted hidden prompts in Claude Desktop
Oasis Security disclosed on July 28 that Claude Desktop's registration of the claude:// URL scheme caused the app to open, import a prompt from the URL, and immediately submit it without showing the full prompt or asking for approval. Visible text looked benign while hidden instructions in the same link were silently executed, enabling conversation-history exfiltration, filesystem reads, and, for anyone running the popular Filesystem MCP server, code execution on the host. Anthropic patched it in Claude Desktop 1.1.2321, where claude:// prompts are now pre-filled but require an explicit user send. The lesson for builders is that any custom URL scheme registered by an agent client is an unauthenticated instruction channel.
↳ Follow the thread