"PromptFiction" Claude Desktop Auto-Submit Flaw Chained With "Claudy Day" Claude.ai Exploit Chain Enables Silent Exfiltration and, via Filesystem Server MCP, Local RCE
"PromptFiction" Claude Desktop Auto-Submit Flaw Chained With (TL-2026-1380), also tracked as PromptFiction, is a high-severity software vulnerability, first published 2026-07-15. It has no confirmed attribution, affects Anthropic Claude Desktop, maps to 22 MITRE ATT&CK techniques (T1027, T1059, T1071.001), and is covered by 9 detection rules and 16 indicators of compromise.
Key facts for TL-2026-1380
- Threat ID
- TL-2026-1380
- Also known as
- PromptFiction, Claudy Day
- Severity
- HIGH
- Status
- PATCHED
- Category
- VULNERABILITY
- First published
- 2026-07-15
- Last reviewed
- 2026-07-15
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- technology, software-development, any-sector-using-ai-agents
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 16
Malware and tooling in "PromptFiction" Claude Desktop Auto-Submit Flaw Chained With
Malware and tooling: Anthropic Filesystem Server (official MCP integration)
Oasis Security disclosed PromptFiction, a flaw in Anthropic's Claude Desktop `claude://` URI-scheme handler that auto-submitted attacker-crafted prompts to Claude with a single click and zero user review. Chained with the previously disclosed three-vulnerability "Claudy Day" attack path (invisible URL-based prompt injection, Files-API data exfiltration, and a claude.com open redirect), the combined chain enabled silent exfiltration of prior conversation history and, when Anthropic's official Filesystem Server MCP integration is installed, local file read/write, persistence, and remote code execution on the victim machine. Anthropic fixed both issues through its Responsible Disclosure Program; the desktop fix shipped in Claude Desktop v1.1.2321.
How "PromptFiction" Claude Desktop Auto-Submit Flaw Chained With works
Oasis Security's research lead Elad Luz documented a two-stage exploit chain against Anthropic's Claude AI product family. The first stage, "Claudy Day" (published 2026-03-18, updated 2026-05-27), consisted of three chained web-based flaws in Claude.ai: (1) invisible prompt injection via the `claude.ai/new?q=` URL parameter, where certain HTML tags embedded in the query string were invisible in the rendered text box but were fully parsed and processed by Claude once the user pressed Enter; (2) data exfiltration through Anthropic's own Files API, abused because Claude's code-execution sandbox blocks arbitrary outbound network access but explicitly allow-lists `api.anthropic.com` — an attacker could smuggle an API key for their own Anthropic account inside the hidden prompt and instruct Claude to search the user's conversation history/memory, write the sensitive findings to a file inside the sandbox, and upload that file to the attacker's account via the Files API; and (3) an open redirect at `claude.com/redirect/<target>` that let attackers disguise the malicious `claude.ai/new?q=` link as a trusted claude.com URL, which was in turn used to get the link approved by ad-network URL validation (which checks hostname only) so it could be purchased as a Google Ads / Gmail ad result targeting selected victims. Oasis stressed that the Claudy Day chain worked against a completely default, bare-bones Claude session — zero integrations, zero tools, zero MCP servers required.
The second stage, PromptFiction (published 2026-07-15), targeted the Claude Desktop application specifically. Claude Desktop registers a custom OS-level URI scheme, `claude://`. Before the fix, a crafted link such as `claude://claude.ai/new?q=<prompt>` would open Claude Desktop and immediately submit the embedded prompt to the agent with a single click and no confirmation screen — unlike the web client, which displays the pre-filled prompt in the compose box pending explicit user send. This let an attacker skip the "user reviews then sends" gate entirely on the desktop app. To reduce operator suspicion, attackers could front-load a benign, friendly request (e.g., "tell me a joke") at the start of the visible prompt text and push the actual malicious instructions further down, exploiting Claude's UI behavior of collapsing long messages behind a "show more" toggle — the harmful payload sat below the fold and was processed in full even though the victim never expanded it. Oasis noted the malicious `claude://` link could be concealed using the same claude.com open-redirect technique documented in Claudy Day, so the final delivery vector again looked like a trusted claude.com address while actually launching the desktop app with attacker-controlled instructions, and could again be distributed via Google Search/Gmail ads aimed at chosen targets.
Chaining the two: a single click from a malicious ad or link opened Claude Desktop and auto-submitted a hidden prompt (PromptFiction) that carried out the Claudy Day exfiltration logic (conversation-history theft via the Files API) with no further interaction. Where the victim's Claude Desktop had Anthropic's official Filesystem Server MCP integration enabled (used to grant Claude read/write access to approved local directories for coding and file-management workflows), the injected prompt could instead direct Claude to write or modify files within those approved directories — for example inserting remote-debugging code into Python or JavaScript project files during what looked like a routine coding task, or appending persistence hooks into shell rc files (`.zshrc`, `.bashrc`) reachable under the approved filesystem scope — escalating the impact from conversation-data theft to local file read/write, persistence across reboots/shell sessions, and ultimately remote code execution on the victim's machine, all without any confirmation dialog beyond the single initial click.
No CVE identifier or CVSS score was assigned to either the Claudy Day or PromptFiction disclosures at time of publication. Anthropic remediated both issues through its Responsible Disclosure Program: the prompt-injection/auto-submit behavior in Claude Desktop was fixed in version 1.1.2321, which now requires the user to manually review and explicitly send any prompt delivered via the `claude://` URI scheme rather than auto-submitting it; the Claude.ai web-side prompt-injection vector from Claudy Day was likewise patched, with Oasis noting some related hardening work continued after initial disclosure.
MITRE ATT&CK techniques used in TL-2026-1380
Defense Evasion
T1027 Obfuscated Files or Information; T1140 Deobfuscate/Decode Files or Information; T1564 Hide Artifacts
Execution
T1059 Command and Scripting Interpreter; T1204.001 Malicious Link
Command and Control
Collection
T1074.001 Local Data Staging; T1119 Automated Collection; T1213 Data from Information Repositories
Discovery
T1083 File and Directory Discovery
Initial Access
T1189 Drive-by Compromise; T1566.002 Spearphishing Link
Persistence
T1505 Server Software Component; T1546.004 Unix Shell Configuration Modification
Credential Access
T1528 Steal Application Access Token
Impact
T1565.001 Stored Data Manipulation
Exfiltration
T1567 Exfiltration Over Web Service; T1567.002 Exfiltration to Cloud Storage
Resource Development
T1583.008 Malvertising; T1585.003 Cloud Accounts
Reconnaissance
T1589 Gather Victim Identity Information
stealth
Affected products and versions in "PromptFiction" Claude Desktop Auto-Submit Flaw Chained With
- Anthropic — Claude Desktop
Vulnerable versions: < 1.1.2321
Fixed in: 1.1.2321 - Anthropic — Claude.ai (web)
Vulnerable versions: pre-patch, prior to 2026-05-27 hardening
Fixed in: patched via Responsible Disclosure Program, prompt-injection vector closed - Anthropic — Filesystem Server (official MCP integration)
Vulnerable versions: any version when installed alongside vulnerable Claude Desktop
Fixed in: mitigated once Claude Desktop 1.1.2321 closes the auto-submit vector
Remediation for "PromptFiction" Claude Desktop Auto-Submit Flaw Chained With
Patches
- Claude Desktop v1.1.2321 — claude:// URI-scheme prompts now require manual user review/send instead of auto-submitting
Immediate actions
- Update Claude Desktop to version 1.1.2321 or later, where claude:// links are pre-filled but require explicit manual review and send rather than auto-submitting
- Treat any claude:// or claude.ai/new?q= link received via email, ads, or search results as untrusted until the prompt content has been fully reviewed before sending
- Audit which local directories are exposed to Claude Desktop via the official Filesystem Server MCP integration and scope them to the minimum necessary paths
- Review shell rc files (.zshrc, .bashrc) and project source files in any Claude-Filesystem-Server-approved directory for unexpected modifications, persistence hooks, or inserted remote-debugging code
Workarounds
- Disable or do not install the Filesystem Server MCP integration on machines used for sensitive work until Claude Desktop is fully patched
- Do not click claude:// or claude.ai links delivered via advertisements, unsolicited email, or unfamiliar search results
Longer-term hardening
- Require explicit user approval before any AI-agent action that reads conversation history/memory and sends it to an external API, even first-party APIs
- Sanitize and validate all URL-based prompt inputs server- and client-side, including detection of hidden/invisible HTML or encoded content embedded in query parameters
- Audit and restrict code-sandbox outbound network allow-lists so a first-party API domain cannot be repurposed as an attacker-controlled exfiltration channel via attacker-supplied credentials
- Fix open-redirect endpoints (e.g., claude.com/redirect/<target>) to validate destination hostnames/paths against an allow-list rather than redirecting unconditionally
- Monitor MCP integrations (Filesystem Server and similar) for anomalous file writes, shell-config modifications, or code insertions that follow an AI agent session
Weaknesses (CWE) in "PromptFiction" Claude Desktop Auto-Submit Flaw Chained With
CWE-77, CWE-79, CWE-601, CWE-306, CWE-200
Timeline of "PromptFiction" Claude Desktop Auto-Submit Flaw Chained With
- Oasis Security releases a companion full technical report PDF ('claudesday-vulnerability.pdf') alongside the Claudy Day blog post, describing malicious-search-result placement as an additional delivery vector for the injected claude.ai/new?q= link, alongside malvertising.
- Oasis Security publishes the Claudy Day research, documenting a three-vulnerability chain in Claude.ai: invisible URL-based prompt injection, Files-API data exfiltration, and a claude.com open redirect, working against a fully default bare-bones Claude session.
- Oasis Security updates the Claudy Day blog post noting the prompt-injection vector has been fixed by Anthropic while other related hardening work continues.
- Oasis Security discloses in the PromptFiction writeup that the finding was a duplicate: an independent researcher had separately reported the same Claude Desktop claude:// auto-submit issue to Anthropic beforehand but chose not to publish their own findings.
- Hackread publishes a technical breakdown of the PromptFiction claude:// auto-submit mechanism and its concealment techniques (front-loaded benign text, 'show more' UI collapse abuse).
- Dark Reading reports on the PromptFiction/Claudy Day chained vulnerability disclosure, summarizing the exfiltration and RCE-via-MCP risk for enterprise readers.
- Anthropic ships Claude Desktop version 1.1.2321, requiring users to manually review and send any prompt delivered via the claude:// URI scheme rather than auto-submitting it, closing the PromptFiction auto-submit vector.
- Oasis documents that PromptFiction can be chained with Claudy Day's open-redirect and exfiltration techniques, escalating impact to silent conversation-history theft and, with Filesystem Server MCP installed, local file read/write, persistence, and remote code execution.
- Oasis Security research lead Elad Luz publishes the PromptFiction finding: a click-to-auto-submit flaw in Claude Desktop's claude:// URI-scheme handler that bypasses the prompt-review step present on the web client.
Sources cited for "PromptFiction" Claude Desktop Auto-Submit Flaw Chained With
- Claude Flaw Automatically Sends Malicious Prompts to AI Agents
- Claude.ai Vulnerability Analysis: Claudy Day (Oasis Security)
- Claude.ai Exploit Chain: Full Technical Report (Oasis Security)
- PromptFiction Flaw Auto-Submitted Hidden Prompts in Claude Desktop (Hackread)
- Three high-risk AI vulnerabilities discovered in Claude.ai (TechRadar)
- Anthropic Coordinated Vulnerability Disclosure Dashboard
Threats related to "PromptFiction" Claude Desktop Auto-Submit Flaw Chained With
Detection coverage for TL-2026-1380
As of 2026-07-15, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1380 across Splunk SPL, Microsoft KQL and Sigma, covering 16 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.