Claude Flaw Automatically Sends Malicious Prompts to AI Agents

A vulnerability, dubbed ‘PromptFiction,’ has been discovered in Anthropic’s Claude Desktop application, allowing attackers to automatically submit malicious prompts to the AI assistant with a single click, bypassing the need for user interaction. Anthropic has released a fix (version 1.1.2321), and users should ensure they are running that release or later to mitigate the risk. This flaw, combined with a previous vulnerability (‘Claudy Day’), could lead to data exposure, code execution, and remote access on a victim’s machine.

PromptFiction works by leveraging a custom URI scheme, ‘claude://,’ which, when clicked, automatically launches Claude Desktop and submits a prepared prompt without requiring user approval. Attackers can use this to inject malicious instructions into the AI assistant’s conversations, potentially accessing user data like private conversations, source code, and internal documents. To obscure the malicious intent, the prompts are padded with benign text to exploit Claude’s message-folding behavior, hiding the instructions below the visible portion of the conversation.

Researchers from Oasis Security discovered the flaw and reported it to Anthropic through the AI company’s Responsible Disclosure Program. The discovery highlights the rapid pace at which attackers are leveraging AI to find and weaponize vulnerabilities in emerging technologies, forcing defenders to adapt to a constantly evolving threat landscape. As Randolph Barr, CISO at API security and bot management provider Cequence Security, notes, ‘The same models that help defenders are helping attackers find and weaponize flaws faster, which means the window between a vulnerability existing and a patch shipping is exactly where organizations are most exposed.’

Experts emphasize that organizations should treat AI agents as a form of ‘shadow IT,’ similar to operational technology (OT) and IoT devices, which can enable lateral movement into corporate networks and storage systems. To address this risk, defenders should implement security controls around AI agents themselves, including monitoring and governing agent API traffic, restricting agent access, detecting anomalous behaviors, and maintaining an inventory of AI agents, MCP servers, and plug-ins. John Gallagher, VP at automated IoT cyber hygiene provider Viakoo, states, ‘Organizations should see AI agents as another form of ‘shadow IT,’ similar to operational technology (OT) and IoT devices, which can enable lateral movement into corporate networks and storage systems.’