A URL pressed Send by itself

Claude Desktop registered a custom claude:// link scheme so websites and other applications could open the assistant. Custom schemes are common. A mailto: link opens an email client; a product-specific link can open the right application and route the user to a particular screen.

Claude's implementation went further. According to the PromptFiction report from Oasis Security, a crafted link could include a prompt, open Claude Desktop, and submit that prompt automatically. The user did not receive the full text for review and did not have to press Send.

Oasis demonstrated the flaw with a decoy ASCII-art tool. The visible page offered an innocent function, while its link carried additional instructions into Claude. One click transferred control from browser content to a desktop agent that could read conversation context and use connected tools.

The vulnerability was not that a link could prefill a draft. Even an imperfect prefill leaves a review boundary before the agent acts. PromptFiction crossed that boundary on the user's behalf. The desktop application treated data embedded in an external URL as an approved message.

The default chain reached conversation history

In a default Claude Desktop setup, the researchers said PromptFiction could be combined with a previously disclosed Claude weakness to search or collect private conversation history and send the result out. This was a chain, not a claim that every crafted claude:// link automatically stole every chat.

The earlier route was Claudy Day, which Vibe Graveyard covered after Oasis disclosed it in March 2026. Claudy Day used a hidden prefilled prompt on Claude's website, Anthropic's Files API, and an open redirect. The victim still had to send the planted prompt. PromptFiction removed that last deliberate action inside Claude Desktop.

That distinction is small in interface terms and large in security terms. A user who clicks a plausible link expects to open a destination. The user does not expect the destination to receive and execute an invisible instruction before there is any chance to inspect it.

Dark Reading's coverage described conversation exfiltration as one demonstrated outcome. Oasis did not report real users whose conversations were stolen through PromptFiction. The evidence is a controlled exploit chain against the product behavior.

Optional tools raised the ceiling

Claude Desktop can connect to external tools through the Model Context Protocol. Anthropic's Filesystem Server is one such tool. When installed and granted access, it lets Claude work with local files rather than remaining inside a chat window.

Oasis reported that a PromptFiction payload could use that configuration to read or write files, establish persistence, or execute code. Those outcomes required the relevant integration and permissions. They were not the default impact for every Claude Desktop installation.

The qualification is important because security reports tend to flatten a chain into its most dramatic endpoint. The base vulnerability auto-submitted an attacker-controlled prompt. Conversation-history theft required another route. Local file access and code execution required a more capable configuration. Each additional permission gave the injected prompt more useful machinery.

That does not make the base flaw minor. Desktop assistants are expressly designed to become more capable as users connect tools and local resources. An input boundary that is merely bad in a chat-only setup becomes dangerous when the same agent can touch the filesystem. The product cannot assume its least-privileged configuration while encouraging users to expand its privileges.

A trusted-looking link was enough

The attack still required the victim to click. That familiar requirement is not much comfort. Links arrive through email, chat, documentation, issue trackers, search results, and websites all day. They can use reassuring anchor text while pointing somewhere else, and a custom scheme is often hidden behind a normal button.

After the click, the expected confirmation lived inside the application. Claude Desktop skipped it. The link both supplied the message and authorized its submission, collapsing two separate decisions into one browser gesture.

User approval is useful only when the user can see what is being approved. A Send button under a visible prompt would not have solved every social-engineering problem, but it would have restored a concrete boundary between opening Claude and instructing Claude. PromptFiction turned that boundary into an implementation detail attackers could bypass with a URL.

Anthropic fixed the auto-submit path

Oasis reported the issue to Anthropic, which fixed it in Claude Desktop version 1.1.2321. Oasis also noted that another researcher had reported the same issue first but had not published it. Users on affected versions needed to update; current versions no longer accept the demonstrated auto-submission behavior, according to the disclosure.

No public source cited by Oasis or Dark Reading documented exploitation in the wild. PromptFiction belongs on the board because a shipping desktop agent accepted a hostile prompt from a link and acted without a review step, not because researchers found a trail of compromised customers.

The flaw also arrived only months after Claudy Day exposed a closely related URL-to-prompt boundary on Claude's web product. The surfaces differed, and PromptFiction removed an additional click inside the assistant, but the design error rhymed: external navigation data was allowed to become agent instruction with too little friction.

Anthropic closed this instance. The less tidy product question remains for every desktop agent adding tools, files, browsers, and custom links: which inputs are merely opened, and which inputs are permitted to speak for the user? PromptFiction's answer was one click. Version 1.1.2321 made it two decisions again.