The debate continues over whether hackers can trick AI agents into betraying users. Meanwhile, Oasis Security recently announced an unsettling finding. New research on the Claude Desktop agent not only found that a convenience feature could be manipulated, but also that the manipulation wasn’t even required.
The attack came from an AI prompt injection called PromptFiction. Disclosed on July 15, PromptFiction allows attackers to manipulate an AI agent into believing an elaborate, fabricated context. Instead of giving a direct command, hackers craft a compelling fictional scenario that tricks the agent into bypassing safety protocols and acting on hidden instructions.
The attack exploits the same URL-scheme convenience that lets a Zoom or email link launch a native app. When applied to Claude Desktop, the mechanism lets a single click deliver a fully-formed instruction set directly to the agent. The agent skips the review step entirely and executes—before the user has any chance to see (let alone approve) what they supposedly “agreed” to.
Can AI Determine Who Issues Instructions?
This agent flaw reframes a familiar security question: It isn't just whether or not malicious text can fool AI. It’s now a matter of…Can AI systems know whether instructions come from a user?
The Oasis proof-of-concept—a decoy tool with a hidden payload—shows how attackers can pair a harmless-looking request with an invisible one. The invisible request quietly exfiltrates conversation history and source code. On machines configured for coding, the request can execute arbitrary code.
To close this immediate gap, Anthropic patched the issue in Claude Desktop. But here’s the underlying lesson: To outlast this single fix, agentic systems must apply provenance checks to every instruction, not just filters on content.
“This worked the way responsible disclosure is supposed to,” wrote Randolph Barr, Chief Information Security Officer at Cequence Security. “Oasis reported the flaw privately, Anthropic patched it, and the fix shipped before disclosure. The report-to-patch timeline isn't spelled out, but from what I'm seeing, Anthropic moved quickly and handled this the way a vendor should.”
AI Assistants Assume Users Issue Instructions
In the baseline trust model, an AI agent should act only on what a user types and approves. The custom security URL-scheme (claude://) for the convenience feature in Claude Desktop is built for legitimate app-launch use. It also sets up the fault line that PromptFiction can expose.
Previously, in a March 2026 report (Three Vulnerabilities, One Click), Oasis uncovered that a hidden prompt could already ride into a Claude chat via a link. That attack still had one safeguard; the user had to press send. The industry treated the send button as the remaining checkpoint.
In this recent PromptFiction discovery, Oasis found the same link channel could now bypass this review entirely. A crafted link delivers a full instruction set that the AI assistant immediately acts on. There’s also a decoy mechanism: a visible harmless request that masks a hidden payload.
With no send button and no review, there’s no way for a user to know what they “agreed” to.
As a result, a single click could actually reach standard installs—including private conversation history, source code, and internal documents exposed to silent exfiltration. A click can also reach coding-configured machines where attackers can control code execution.
As Oasis frames this type of attack, it’s not a case of AI turning rogue; it’s a system with no proof of who issues an instruction.
“What made the flaw notable is that one click on a crafted claude:// link could auto-submit instructions to Claude Desktop…no send button, no chance to review,” Barr noted. “And if the user had the popular Filesystem MCP (Model Context Protocol) Server installed, it escalated from data exposure to potential code execution on the victim's machine.”
Fix Does Not Answer the Key Governance Question
Following the patch that Anthropic deployed for Claude Desktop, a human in the loop has now been restored. Pre-filled instructions wait for an explicit <send> prompt.
However, there’s still an unresolved lesson. Content filtering does not establish provenance. Agents need verification of intent for each action, not just onboarding-time trust.
“Organizations should see AI agents as another form of shadow IT, similar to operational technology (OT) and IoT devices that are operated outside of IT,” recommended John Gallagher, Vice President at Viakoo. “Not only do these agents often have privileges, but they also can enable lateral movement into corporate networks and storage systems. Governance is clearly lacking in this area. Non-human identity management is in its early stages, and this is an example of AI getting ahead of the proper controls around it.”
