Notifications
Clear all
Topic starter
15/08/2026 8:29 pm
TL;DR: A one-click flaw in Claude Desktop let a crafted link feed instructions directly to the assistant, bypassing user review and, in some configurations, reaching private conversations or code execution, according to Oasis Security. The core failure is that current AI access controls still assume prompts arrive from an approved human at the moment of action.
NHIMG editorial — based on content published by Oasis Security: PromptFiction, a one-click flaw that made Claude Desktop act without consent
By the numbers:
- 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems, inappropriately sharing sensitive data, and revealing access credentials.
Questions worth separating out
Q: What breaks when an AI assistant accepts instructions before a human reviews them?
A: The approval model breaks, because the system can no longer prove that the instruction was user-authored or user-approved.
Q: Why do AI assistants with file or memory access increase security risk?
A: Because the assistant’s delegated access defines the blast radius of any prompt injection.
Q: How should security teams implement approval controls for AI assistants?
A: Place the approval control at the point of execution, not just at login or onboarding.
Practitioner guidance
- Separate prompt delivery from action approval Require an explicit human confirmation step before any AI assistant executes a real action, especially when the instruction originates from a link, attachment, or hidden prompt content.
- Validate instruction provenance Log and inspect where prompts came from, how they were inserted, and whether the visible text matched the content actually consumed by the assistant.
- Reduce delegated assistant scope Limit chat history, file access, and tool invocation to the smallest task-bound permissions needed, and remove blanket trust from desktop AI deployments.
What's in the full report
Oasis Security's full blog post covers the technical detail this post intentionally leaves for the source:
- A step-by-step explanation of how the crafted Claude Desktop link delivered hidden instructions into the assistant.
- Configuration-specific behaviour showing what the assistant could access on standard installs versus coding-enabled setups.
- The precise mitigation change Anthropic applied after disclosure, including how the pre-filled prompt now waits for explicit user send.
- A technical walkthrough of the attack path and why the visible content could differ from the prompt content the assistant processed.
👉 Read Oasis Security's analysis of the Claude Desktop prompt injection flaw →
Claude Desktop prompt injection: are your controls keeping up?
Explore further
15/08/2026 8:29 pm
Prompt provenance is the control that failed here. The security assumption was that instructions reaching the assistant were authored or approved by the human who opened the session. PromptFiction shows that assumption is too weak when a link can smuggle instructions into the runtime path. The practical conclusion is that AI governance must separate launch, prompt delivery, and action approval instead of treating them as one event.
A few things that frame the scale:
- 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems, inappropriately sharing sensitive data, and revealing access credentials, according to AI Agents: The New Attack Surface report.
- 52% of companies can track and audit the data their AI agents access, leaving 48% with a complete blind spot for compliance and breach investigation.
A question worth separating out:
Q: Who is accountable when an AI agent performs an unauthorized action after injection?
A: Accountability follows the governance model that granted the agent its permissions and execution rights. The owner of the agent workflow, the approver of its tool scope, and the team operating the control plane all share responsibility. Frameworks such as OWASP-NHI and zero trust expect those boundaries to be explicit.
👉 Read our full editorial: Claude Desktop prompt injection exposes the human approval gap
