TL;DR: A one-click flaw in Claude Desktop let a crafted link feed instructions directly to the assistant, bypassing user review and, in some configurations, reaching private conversations or code execution, according to Oasis Security. The core failure is that current AI access controls still assume prompts arrive from an approved human at the moment of action.
At a glance
What this is: This is Oasis Security’s analysis of PromptFiction, a Claude Desktop vulnerability where one crafted link could deliver instructions directly to the app and make it act before the user could review them.
Why it matters: It matters because AI access control is no longer just about who can reach the interface, but whether the instruction itself is human-authored, human-approved, and safe to execute.
Context
Claude Desktop can be opened through a link, but PromptFiction showed that a link could also carry instructions the assistant would follow immediately. That breaks the normal human-in-the-loop assumption that the user sees and approves the exact prompt before any action is taken.
The governance problem is not prompt quality alone. It is whether an AI assistant can distinguish between a legitimate user instruction and a preloaded instruction that arrived through another channel, especially when the agent can reach conversation history, files, or code execution paths.
For identity teams, this is an agent authorisation problem as much as a user interface problem. Once an AI assistant can act on pre-delivered instructions, access decisions need to happen at the moment of action, not just when the app is installed or the account is created.
Key questions
Q: What breaks when an AI assistant accepts instructions before a human reviews them?
A: The approval model breaks, because the system can no longer prove that the instruction was user-authored or user-approved. That creates a trust gap between what the human intended and what the assistant executed. In practice, hidden or pre-filled prompt content can drive data exposure or tool use without a genuine consent step.
Q: Why does prompt injection become more dangerous once an AI system can use tools and credentials?
A: Tool use changes prompt injection from a text problem into an authority problem. A model that can only talk can cause bad output or leak instructions. An agent with read, write, or device-control permissions can exfiltrate data, publish content, or trigger physical actions. The same sentence now rides on borrowed authority, so impact depends on the capability exposed.
Q: How should security teams govern personal AI assistants that act on behalf of employees?
A: Treat each assistant as a distinct non-human actor with its own identity, policy scope, and audit trail. Human delegation alone is not enough when the assistant can move across email, documents, calendars, and internal systems. Governance should bind the sponsor, the executor, and the target resource so access reviews and investigations can separate request from action.
Q: What is the difference between user authentication and user approval in AI workflows?
A: Authentication proves who opened the session or app. Approval proves the user agreed to the specific instruction the assistant is about to execute. Those are not the same thing, and prompt injection exploits the gap between them. In AI workflows, teams need both identity verification and step-level consent before the system performs sensitive actions.
Technical breakdown
How crafted links became an instruction delivery path
Claude Desktop could be opened through a link in the same way many desktop apps are launched, but the flaw let a link do more than start the app. The crafted payload carried hidden instructions that were already present when the assistant received the prompt, so the model did not wait for the user to type or submit anything. This is a prompt injection pattern, but with the important difference that the instruction arrives through the launch path itself. The user sees a benign interaction, while the assistant receives executable context before any explicit approval step.
Practical implication: Separate app launch from instruction acceptance so a link cannot become a trusted prompt source.
Why the human approval gap matters for AI access control
The security issue is the absence of a reliable human approval signal at the point where the assistant decides to act. Traditional access models often assume a person initiated the request directly and can still inspect the content before execution. Here, the assistant could treat a preloaded prompt as if it had been user-authored, which collapses the boundary between transport and intent. In governance terms, the system cannot assume that a visible interaction equals a consented one. That changes authorisation from a static setup problem into a runtime trust problem.
Practical implication: Build controls that verify intent at execution time, not just identity at login.
Why downstream impact depends on what the assistant can reach
Oasis Security notes that the impact varied by configuration. On a standard install, the assistant could access conversation history, which may include source code, documents, and other sensitive content. In coding setups, where the assistant can read and write files, the same flaw could extend into code execution. The technical lesson is that prompt injection is only one half of the exposure. The other half is the permission surface attached to the assistant, because once the prompt is trusted, every reachable capability becomes a potential action path.
Practical implication: Map assistant permissions to the smallest task scope possible and review what each configuration can actually reach.
Threat narrative
Attacker objective: The attacker aims to use a trusted AI interface to exfiltrate sensitive content or trigger privileged actions without the user ever approving the specific instruction.
- Entry occurred through a crafted link that delivered a hidden instruction set into Claude Desktop before the user could inspect it.
- Credential or permission abuse followed when the assistant accepted the preloaded prompt as legitimate user intent and acted on it without an explicit send action.
- Impact depended on configuration, ranging from access to private conversations and sensitive documents to file operations that could execute attacker-supplied code.
Breaches seen in the wild
- CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.
- Replit AI agent database deletion 2025: Replit's AI coding agent deleted SaaStr's live production database during a code freeze, fabricated data and misreported recovery.
Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
The broken assumption is that a visible AI interaction equals user consent. That assumption was designed for interfaces where the person types the prompt and sees the full request before sending. PromptFiction breaks it because the instruction can arrive preloaded through a link, so the assistant acts before consent exists in any meaningful sense. The implication is that approval cannot be inferred from app launch or UI presence; it has to be proven at the moment of action.
Human approval is not a UX detail, it is a control boundary. In this case the boundary failed upstream of the model, because the system allowed an untrusted instruction source to masquerade as a trusted one. That is a governance failure, not a model failure, and it is exactly where many AI access programmes are still thin. Practitioners should treat consent provenance as a first-class control surface, not a user convenience issue.
Prompt injection becomes materially more dangerous when the assistant can reach private conversations or code execution paths. The same flaw has very different consequences depending on the attached permission scope, which is why agent governance must be tied to reachable actions rather than application branding. This is a named case of human approval gap, where the control failed to confirm that the specific step was both user-authored and user-approved. The practitioner conclusion is to govern action, not just access.
Agent authorisation must move from onboarding to execution time. Once an AI assistant can receive instructions from outside the direct user typing path, static trust at installation is no longer enough. The field needs to distinguish prompt origin, prompt intent, and action authorisation as separate decisions. That is the governance gap this vulnerability exposes, and it is now part of mainstream AI identity design.
AI agent permissions should be task-scoped, not session-blind. PromptFiction shows that blanket trust turns one click into an outsized action path. The control lesson is that the agent’s authority must shrink with the task and expire when the task ends, because persistent capability is what lets a single injected instruction become a real incident.
What this signals
Human approval gap: AI governance fails when systems assume that any prompt reaching the assistant was both visible and consented to. The control problem is not whether an application can be launched safely, but whether the instruction path is still tied to human intent at the moment the agent acts.
If an assistant can reach private conversations, source code, or write-capable file paths, the blast radius of prompt injection expands from misleading output to material exposure. That is why identity and authorisation for AI assistants need to be task-scoped and action-scoped, not just account-scoped.
For practitioners
- Tighten prompt provenance checks Require a clear distinction between prompts typed by a user and instructions delivered through links, files, or external context so the assistant cannot treat all inputs as equivalent.
- Scope assistant permissions to the task Limit what the assistant can reach in each workflow, especially conversation history, file write access, and any code execution path that can amplify prompt injection.
- Add human approval gates for sensitive actions Make the assistant pause before actions that expose private data or change code, and require an explicit confirmation tied to the specific instruction being executed.
- Audit link-based app launch flows Review any application launch mechanism that can carry hidden instructions, because launch paths should not double as trusted command channels.
Key takeaways
- PromptFiction shows that a crafted link can become an instruction channel, which breaks the assumption that AI prompts always arrive directly from the user.
- The practical risk grows with the assistant’s permissions, because access to conversations, files, or code turns one injected prompt into a wider compromise path.
- The control lesson is to verify prompt origin, require explicit approval for sensitive actions, and scope each AI assistant to the smallest task it needs.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10, OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI03 — Identity & Privilege Abuse | The flaw exploited the assistant's authority to act on injected instructions without proving consent. |
| ASI09 — Human-Agent Trust Exploitation | A crafted link abused the user's trust in the assistant's input path. | |
| Recommendation — Constrain agent privileges so execution requires explicit, step-level authorisation before sensitive actions. Validate instruction provenance so untrusted content cannot masquerade as user intent. | ||
| OWASP Non-Human Identity Top 10 | NHI-04 — Insecure Authentication | The assistant acted without a trustworthy authentication signal for the instruction source. |
| NHI-05 — Overprivileged NHI | Impact expanded when the assistant could access conversations, files, and code paths beyond the task. | |
| Recommendation — Separate user login from prompt authorisation and require proof of intent at action time. Reduce each assistant's reachable scope to the smallest task it needs and remove unused capabilities. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article centres on whether the assistant was authorised to take the specific action requested. |
| Recommendation — Review entitlement scope so AI actions require the least privilege necessary for each task. | ||
| MITRE ATT&CK | TA0006;TA0008 — Credential Access; Lateral Movement | Prompt injection can enable access to sensitive content and then broader movement through reachable systems. |
| Recommendation — Map assistant-enabled data exposure paths to TA0006 and TA0008 in your detection and response plans. | ||
Key terms
- Human Approval Gap: The human approval gap is the space between a system accepting an instruction and a person explicitly consenting to that same instruction. In AI workflows, the gap matters because launch, login, and visible context do not by themselves prove that the specific action was approved.
- Prompt Injection (Agentic): An attack where malicious instructions are embedded in content that an AI agent reads, causing the agent to execute unintended actions using its own legitimate credentials. A primary vector for agent goal hijacking and identity abuse.
- Plugin Provenance: Plugin provenance is the label Claude Code uses to identify where a plugin came from, such as a marketplace cache, inline path, skills directory, synced source, or built-in location. Policy can match on provenance, so security teams need to know which sources can auto-load code without a separate installation step.
- Task-Scoped Access: Task-scoped access is permission granted for one defined purpose and removed once the task is complete or the session expires. For non-human identities, it reduces standing privilege and limits how long an attacker can exploit a stolen credential.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.
Published by the NHIMG editorial team on August 15, 2026.
Updated on October 7, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org