PromptFiction: One Click on a claude:// Link Ran a Prompt Nobody Approved - Claude Desktop Before 1.1.2321

PromptFiction, disclosed by Oasis Security in July 2026, was a one-click flaw in Claude Desktop: clicking a crafted claude:// link opened the app, took a prompt out of the link, and submitted it - with no confirmation screen and no opportunity to read the instructions first. The visible text could say one thing while the prompt did another. Anthropic fixed it in Claude Desktop 1.1.2321 after a report through its Responsible Disclosure Program, and no CVE was assigned. This advisory covers what the flaw was, why a registered URL scheme is an execution surface rather than a convenience, and how to inventory and govern the agents on your fleet that register one.

What happened

Claude Desktop registers a custom URL scheme, claude://. Registering a scheme tells the operating system that one application handles links of that form, so a link on a web page, in an email, or in a Slack message can hand data straight to a local application. Oasis found that Claude Desktop accepted a prompt embedded in that link and submitted it automatically. In Oasis's words, the app "opens, takes a prompt from the link, and submits it. The user never sees the full prompt, and never approves it."

The deception is the important part. A link can be presented as something harmless - Oasis used an ASCII-art generator as the lure - while the prompt actually carried instructions the user never read. There was no diff, no preview, and no approval step between the click and the model acting on attacker-authored text. The user's own trusted client did the asking, so nothing about the interaction looked unusual.

Oasis enumerates four outcomes: hidden prompt injection, code execution, conversation-history exfiltration, and file-system access. The reach comes from the client, not the link - Claude Desktop holds the user's session, their conversation history, and whatever local tools and connectors they have wired up, so a prompt that arrives this way inherits all of it. The researchers also chained it with an earlier technique of theirs, Claudy Day, to pull content out of previous conversations, write it to a file, and upload it through Anthropic's Files API using credentials supplied by the attacker, turning a single click into a data-exfiltration path out of the user's own chat history.

Claude Desktop 1.1.2321 fixed it, so the remediation is a version check rather than a configuration change. What does not get fixed by that patch is the shape of the problem. A registered URL scheme is a permanent, OS-level inbound channel into a local application, and PromptFiction is one of at least four one-click flaws disclosed against agent clients in 2026 - alongside DeepJack in Cursor, Envade in VS Code, and a claude-cli:// deeplink issue in Claude Code patched in 2.1.118. Same class, four different products.

Why this is an agentic-endpoint risk

Nothing here was malware. A signed, legitimately installed desktop application did exactly what it was built to do - handle its own URL scheme - and the malicious content arrived as a link. That is the recurring shape of the agent-layer problem: the capability is real and sanctioned, the input is untrusted, and the boundary between them is a UI affordance rather than a control. PromptFiction removed even the affordance, because there was no prompt to approve.

It is also close to invisible to the tooling you already run. A claude:// click is a local URL-scheme handoff, so there is no network request for a proxy to inspect. EDR sees a signed application the user installed on purpose. DLP sees nothing at rest, and the exfiltration in the chained variant leaves as an ordinary authenticated upload to a vendor API. The interesting question is not whether one desktop app is patched - it is which agent clients across your fleet register a URL scheme, what each of them will do with an unreviewed prompt, and which tools those prompts can reach. That is inventory work, and almost nobody has it.

This is the same trust-boundary failure we have covered in the IDE agents - Cursor's MCPoison workspace-trust bypass and CurXecute - and the mechanism behind indirect prompt injection generally. The exfiltration path is a clean instance of the lethal trifecta: private data, untrusted input, and an outbound channel in one session. Desktop AI clients spread the way AI agents became the new shadow IT - installed by individuals, counted by nobody.

How Anomity surfaces and governs it

First, inventory the clients and their versions. Anomity's unprivileged Endpoint Sensor runs on Windows, macOS, and Linux and inventories eight AI artifact types per endpoint - AI agents, MCP servers, extensions, plugins, skills, secrets, hooks, and CLIs. Claude Desktop is an inventoried artifact with a version, so "which endpoints run a build before 1.1.2321" is one query instead of a fleet-wide hunt, and the same query answers the next one-click disclosure against a different client.

Second, decide at the tool call, not at the prompt. The defining property of PromptFiction is that there was no prompt to approve, so a control that depends on the user reading something was never going to help. Where an agent exposes a hook - for example the PreToolUse event in Claude Code - Anomity evaluates each call against policy and returns allow, deny, or log before it runs. A prompt that arrives from a link still has to get through the boundary to read a credential file, spawn a process, or upload to an external API, and that is where runtime governance applies regardless of how the instruction got in.

Third, keep the record. Installs, version changes, and policy decisions land in a queryable 90-day audit trail, so after a disclosure like this you can answer which endpoints ran a vulnerable build, during what window, and what those clients actually did - from a record rather than a reconstruction. Anomity collects metadata only, with on-endpoint secret redaction, so the credentials this class of attack reaches for are never centralized. Findings route to SIEM, Slack, email, or Jira, the platform is SOC 2 Type II, and it complements EDR, DLP, network, and GRC tooling at the layer they were not built to see. See how it works.

You can't govern what you can't see.The Anomity principle

What to check across your fleet

• Inventory every endpoint running Claude Desktop and record the version; update anything before 1.1.2321, and verify the running build rather than trusting the auto-updater.
• Enumerate which AI clients on your fleet register a custom URL scheme - claude://, cursor://, claude-cli://, vscode:// and equivalents - since each one is an OS-level inbound channel into a local agent.
• Review what a prompt arriving through those schemes can reach: connected tools, MCP servers, local files, and any API credentials the client already holds.
• Treat conversation history as sensitive data with an exfiltration path, not as a UI convenience - the chained variant read prior conversations and uploaded them with attacker-supplied credentials.
• For anyone who clicked an untrusted link into an AI client on a pre-fix build, review the client's conversation history and connector activity for actions the user did not initiate, and rotate credentials the client could reach.
• Confirm agent tool calls are evaluated at a hook with allow/deny/log rather than trusted by default, so an unreviewed prompt still meets a boundary - see Claude Code permissions and hooks hardening.
• Extend the same review to the other clients in this class, per securing AI coding agents and CLIs, and run the credential-and-data-access path of your AI agent incident response playbook rather than improvising.

PromptFiction is patched, and the class is not. A registered URL scheme means any web page, email, or chat message can hand input to a local agent, and the only thing standing between that input and your data is whatever the client chooses to ask the user - which in this case was nothing at all. Patch to 1.1.2321, then inventory which agent clients on your fleet accept input this way and what their tool calls are allowed to do. For the wider pattern see the MCP Server Security guide and indirect prompt injection explained. To see which endpoints run a vulnerable client and what runtime governance would deny, request early access.