Fetching from the wire…
01
02
03
04
05
06
07
08
Security2026-07-29 · source-backed
Oasis found that Claude Desktop's registration of the claude:// URL scheme caused the app to open, import a prompt from the URL, and immediately submit it with no display of the full prompt and no approval step. Visible text looked benign while hidden instructions in the same link executed silently, enabling conversation-history exfiltration, filesystem reads, and code execution for anyone running the Filesystem MCP server. Patched in Claude Desktop 1.1.2321, where prompts are pre-filled but require an explicit send. Generalize the lesson: any custom URL scheme registered by an agent client is an unauthenticated instruction channel into that agent.
Each link below shares sources, entities, or timing with this story.
Claude Code uses Claude Desktop / Shared entity: Claude Desktop / Shared topic / Earlier coverage
Linked by a graph relationship (Claude Code uses Claude Desktop); both cover Claude Desktop; overlapping topics (agent, claude, client, desktop, hidden).
Claude Code uses Claude Desktop / Shared entity: Claude Desktop / Shared topic / Earlier coverage / Tension
Linked by a graph relationship (Claude Code uses Claude Desktop); both cover Claude Desktop; overlapping topics (claude, client, desktop).
Claude Code uses Claude Desktop / Shared entity: Claude Desktop / Shared topic / Earlier coverage
Linked by a graph relationship (Claude Code uses Claude Desktop); both cover Claude Desktop; overlapping topics (agent, claude, prompt).
Claude Code uses Claude Desktop / Shared entity: Claude Desktop / Shared topic / Earlier coverage / Tension
Linked by a graph relationship (Claude Code uses Claude Desktop); both cover Claude Desktop; overlapping topics (claude, desktop).
Oasis Security criticizes Claude Desktop / Shared entity: Claude Desktop / Shared topic / Earlier coverage / Tension
Linked by a graph relationship (Oasis Security criticizes Claude Desktop); both cover Claude Desktop; overlapping topics (claude, desktop).
Anthropic released Claude Desktop / Shared topic / Tension
Linked by a graph relationship (Anthropic released Claude Desktop); overlapping topics (agent, claude, desktop, instruction); pushes against this story (but).
Claude Code uses Claude Desktop / Shared entity: Claude Desktop / Shared topic / Earlier coverage
Linked by a graph relationship (Claude Code uses Claude Desktop); both cover Claude Desktop; overlapping topics (claude, desktop).
Cyera acquired Oasis Security / Shared entities
Linked by a graph relationship (Cyera acquired Oasis Security); both cover Oasis, Oasis Security.