ClaudeBleed Flaw Leaves Gmail and Google Docs Exposed

Anthropic’s Claude desktop app gives users direct access to its generative artificial intelligence tools, but links and local-computer permissions can widen the software’s attack surface. Security researchers identified a vulnerability dubbed PromptFiction that showed how prompt-injection techniques could move beyond a webpage and affect a desktop application, raising risks to private conversations and, in more privileged configurations, files and code stored on a user’s device.

The researchers said an attacker could craft a malicious link that, once clicked, caused Claude’s desktop app to submit concealed instructions automatically and potentially expose conversation data. The impact could become more severe if the application had permission to access local files, creating a path for malicious code to be planted on the computer. Anthropic addressed the flaw in Claude desktop version 1.1.2321, and users are advised to update to the patched release.

Anthropic’s Claude Chrome extension can operate webpages on a user’s behalf, giving it access to tab content and sensitive data. Cybersecurity firm LayerX named the design flaw ClaudeBleed, warning that malicious extensions requiring no special permissions could cross trust boundaries and hijack the AI agent. The flaw highlights the security risks created as browser-based AI tools gain broader privileges.

As of July 20, 2026, Anthropic had released a patched version, but LayerX testing found that version 1.0.70 still did not eliminate the underlying design issue. Attackers could potentially continue using malicious Chrome extensions to control Claude and exfiltrate data. No information has been disclosed about the number of victims, financial losses or the patch’s release date, and users should continue limiting extension permissions and checking installation sources.

Anthropic’s Claude Chrome extension can read webpage content and help perform browser tasks, but that capability also creates a risk that the AI may mistake text from an untrusted website for instructions. Cybersecurity firm Koi Security named this type of zero-click prompt-injection technique ShadowPrompt, highlighting a new security risk facing AI assistants with agentic capabilities.

Koi Security recently disclosed that attackers could embed hidden prompts in malicious websites, allowing Claude to be covertly manipulated and diverted from its intended task without the user clicking or entering anything. Anthropic patched the vulnerability by the end of 2025. Public reports have not specified the exact patch date, the number of victims or any related financial losses.