TECH NEWS

One-click Claude Desktop Flaw Could Enable Hidden Prompt Injection And Code Execution

https://informationsecuritybuzz.com/wp-content/uploads/One-click-Claude-Desktop-flaw.jpg

Security researchers at Oasis Security have disclosed a vulnerability in Claude Desktop that could allow attackers to execute hidden prompts, access local files, exfiltrate conversation history, or execute code with a single click on a malicious link.

The vulnerability, dubbed PromptFiction, affects the way Claude Desktop handled claude:// links.

According to the researchers, clicking one of these links caused the application to automatically open, import a prompt from the URL, and immediately submit it without displaying the full prompt or requiring user approval. Anthropic addressed the issue in Claude Desktop version 1.1.2321.

Hidden instructions

Oasis Security demonstrated the attack using what appeared to be an innocuous ASCII art tool.

The visible portion of the prompt looked legitimate, while hidden instructions embedded in the same link were silently processed by Claude Desktop after the user clicked it.

According to the report, the same technique could be used to “plant a hidden...

Copyright of this story solely belongs to informationsecuritybuzz.com. To see the full text click HERE

Read more

https://tii.imgix.net/production/articles/18126/47333577-ed46-4eb6-8dd8-9e3a05dd7e89-iX3usl.png?fm=jpeg&auto=compress&w=610

Public records appear to show SpaceX building a “Starbase supercomputer” in TX, but Gina Hinojosa's election as governor may delay some of the data center plans

Featured Podcasts Big Technology Podcast: AI Stockpocalypse, Anthropic Nears RSI?, Prediction Markets vs. Pollsters The Big Technology Podcast takes you behind the scenes in the tech world featuring interviews with plugged-in insiders and outside agitators. Subscribe to Big Technology Podcast. Machine Gods: The Purple Tsunami Against Data Centers The official