2026-09-16 · AI red teaming
One-click prompt injection: what PromptFiction changed for AI agents
Oasis Security found a bug in Claude Desktop that removed the last human checkpoint in a prompt injection. A crafted claude:// link opened the app and submitted an attacker-written prompt. The user never hit Send. Dark Reading's Elizabeth Montalbano reported the research on July 15. Oasis named it PromptFiction. Anthropic has patched it.
The interesting part is not that Claude had a URI handler. The interesting part is how many SaaS agents still assume someone will read the prompt before it runs.
What Oasis documented
Claude Desktop registered a custom URI scheme. A link in a browser, a chat message, a document, or a search result could launch the app, start a new conversation, and send a prepared prompt. Elad Luz, research lead at Oasis, wrote that a single click was enough to put attacker-authored instructions in front of the agent and have them executed.
Oasis padded the prompt with harmless text so Claude's message-folding hid the real instructions below the fold. Combined with an earlier set of Claude issues Oasis called Claudy Day, that chain could reach prior chat history and, if Anthropic's official Filesystem Server was installed, local files, persistence, and code execution on the machine.
Anthropic fixed PromptFiction in Claude Desktop 1.1.2321. Oasis reported it through Anthropic's disclosure program and noted a duplicate: another researcher had already filed the same issue and chose not to publish. Luz made no claim to sole discovery.
Claudy Day was a different shape. That one smuggled an invisible prompt into a pre-filled claude.ai URL and still needed the user to press Enter. PromptFiction deleted that step.
The pattern that outlives the patch
Custom URI schemes exist because they are convenient. They are also a known way for an untrusted page or email to pass arguments into a desktop app that trusts those arguments too much. Any SaaS product that deep-links into an agent, pre-fills a prompt from a URL, or auto-submits a tool call has a version of this surface.
Most teams still test prompt injection as "can a user type something nasty in the box." That test never sees a link that skips the box.
If your agent can call tools, read files, or talk to customer data, the question is whether any external channel can populate and fire a prompt without a person reviewing it. Chat deep links, "open in app" buttons, calendar descriptions, and support macros that launch an agent all count.
What to check in your own product
List every path that can put text in front of an agent. Include URLs, file uploads, and any protocol handler you registered.
Require a visible confirmation before an agent runs a tool with write or execute rights. If the product cannot show the prompt, it should not auto-send.
Treat auto-submit as a security decision, not a UX polish. PromptFiction existed because the send step was treated as implied.
If you already ship an AI assistant that opens from a link or a ticket, this belongs in AI red teaming. The finding you want is simple: can we get the agent to act on text the user never approved.
At Faultline Security we test AI agents for European B2B SaaS companies, including prompt injection that never goes through the chat box. If your assistant can be launched from a URL, get in touch.