Claude Desktop Link Bug Auto-Ran Hidden Prompts

How the attack worked

Researchers found that Claude Desktop registers itself as a handler for the claude:// custom URL scheme. A crafted link, such as one opening a new conversation with a simple request, could cause the app to launch and automatically submit an attacker-written prompt without giving the user a chance to review or send it. Because the interface collapses long messages behind a 'show more' option, attackers could place a friendly-looking request at the top of a message while burying malicious instructions further down where a user would likely never scroll.

In some configurations, this could go beyond a nuisance. Hidden instructions could direct Claude to retrieve prior conversation content, save it as a file, and upload it through Anthropic's Files API using credentials supplied by the attacker, meaning the exfiltrated material would land in the attacker's own account. Where filesystem access was enabled through a connected MCP server, injected prompts could also influence future file edits or persist through shell configuration files.

Why it succeeded

The technique relied on a few things working together: a link format most users don't recognize as risky, an interface that hides content by default, and an application that acted on instructions without requiring confirmation. Attackers reportedly compounded this by using an open redirect on the claude.com domain to disguise the true claude:// destination, so a link could appear to come from a trusted Claude address while actually redirecting the operating system into the app. These disguised links could then be placed in ads on platforms like Google Search or Gmail aimed at selected targets.

What to watch for

• Links using app-specific schemes like claude:// instead of a normal https address
• Unusually long messages with content collapsed behind 'show more'
• A desktop AI app opening and submitting a request without asking for confirmation
• Ads or emails containing links from a familiar domain that behave unexpectedly

How to build resistance

Organizations using Claude Desktop or similar desktop AI assistants should keep the software updated, since Anthropic changed the behavior so claude:// prompts are now pre-filled but require the user to actively review and send them. Employees across roles, including executives, engineering, finance, and HR, should be encouraged to treat unexpected app-launching links as suspicious, expand any collapsed message content before trusting it, and verify the actual destination of links delivered through ads or email rather than assuming a familiar-looking domain guarantees safety.

What was the Claude Desktop link vulnerability?

Claude Desktop accepted attacker-controlled prompt text through its claude:// custom URL scheme and could auto-submit that prompt after a single click, without letting the user review it first.

How did attackers hide malicious instructions?

Attackers placed harmful instructions in the collapsed portion of a long message, behind Claude's 'show more' option, so a user saw a harmless request like a joke or ASCII art while the full prompt contained hidden commands.

Could this flaw lead to data theft?

Yes, injected prompts could instruct Claude to retrieve prior conversation content and upload it via Anthropic's Files API using attacker-supplied credentials, with the uploaded material appearing in the attacker's account.

Is Claude Desktop still vulnerable?

Anthropic changed the behavior so claude:// prompts are now pre-filled but require user review and sending, a fix that Oasis Security says shipped in Claude Desktop version 1.1.2321.