"PromptFiction": Claude Desktop `claude://` Links Auto-Submitted Attacker Prompts

Anthropic's Claude Desktop application before version 1.1.2321

A single click on a trusted-looking link ran an attacker's instructions inside Claude Desktop with no confirmation and no review. The app accepted a `q` parameter on its custom `claude://` URL scheme, so a link such as `claude://claude.ai/new?q=...` opened a conversation and submitted the prompt automatically. The web version required manual confirmation; the desktop app skipped it. Long prompts hid the malicious portion behind a collapsed "show more" section, and researchers demonstrated a decoy tool request the user could read alongside instructions they could not. Injected prompts could extract prior conversations, upload chat history through the Files API, and, where filesystem access was available through connected MCP servers, write remote debugging code into scripts for execution. Anthropic fixed it through its responsible disclosure program; prompts arriving via `claude://` are now pre-filled and require the user to review and send them

A custom URL scheme handler treated an externally supplied parameter as a user-authored prompt and auto-submitted it, with no user-gesture requirement and no display of the full prompt before execution. Found by Oasis Security