Prompt injection crossed from proof-of-concept to live exploitation in 2026. In the space of a few months, researchers disclosed a one-click flaw in Claude Desktop that could silently exfiltrate conversations and reach remote code execution, showed six AI browsers being tricked into leaking credentials, caught indirect prompt injection on live websites hijacking agents into cryptocurrency payments, and demonstrated “unseeable” injections hidden inside screenshots. The through-line is that the attack no longer needs a controlled demo. Untrusted content on the open web is now enough to redirect an AI agent that a real person is using.
We wrote the prompt injection defender’s playbook for teams shipping LLM features. This piece is the field update: the specific in-the-wild cases from 2026 that turned a known theoretical risk into an operational one, and what each reveals about where the exposure actually sits. The uncomfortable conclusion, shared by vendors including OpenAI, is that this is a property of how models process text, not a single bug anyone can patch away.
The one-click Claude Desktop flaw
Oasis Security disclosed a flaw they named PromptFiction that removed the last human checkpoint from a prompt-injection attack. Claude Desktop registers a custom claude:// URI scheme, and a crafted link automatically opens the app and submits a prepared prompt to the agent with no send action for the user to review. A single click, in a browser, a chat message, a document, or a search result, put attacker-authored instructions in front of the agent. The prompt was padded with benign text to exploit message-folding, hiding the malicious portion below the visible conversation so the victim saw only an innocuous request.
Chained with a prior trio of issues the researchers called Claudy Day, the impact reached silent exfiltration of previous conversations and, where Anthropic’s official Filesystem server was installed, read/write access to local files, persistence, and ultimately remote code execution on the victim’s machine. Anthropic fixed the flaw. The lesson is not that one vendor slipped. It is that a URI handler plus an agent with tool access collapses “click a link” into “run attacker instructions,” the same escalation path we mapped for the MCP attack surface.
AI browsers are the softest surface
AI browsers concentrate the risk because they read untrusted web content and act with the user’s authenticated session. Brave’s research team demonstrated “unseeable” prompt injections hidden inside screenshots, injections invisible to the user but fully legible to the model processing the image, in Comet and other AI browsers. Separately, researchers tricked six different AI browsers into leaking credentials. The pattern is consistent: the browser treats page content, including content designed to look like instructions, as something to act on rather than merely to summarise.
OpenAI’s own position is that AI browsers may always be vulnerable to prompt injection, because the model cannot reliably distinguish a legitimate instruction from a malicious one embedded in the content it is told to read. That is a structural admission, not a hedge. It means the defensive burden falls on architecture: constraining what an agent is allowed to do without a human in the loop, not on the hope that the model will learn to ignore hostile text.
Injection that moves money
The clearest sign that this is operational rather than academic is that it now targets funds. Unit 42 observed web-based indirect prompt injection in the wild, and separate research uncovered campaigns embedding injections in malicious websites specifically to trick autonomous AI agents into making cryptocurrency payments. When an agent has payment authority and browses attacker-controlled pages, the injected instruction does not have to exfiltrate anything slowly. It can simply tell the agent to send money, and the agent, unable to tell the instruction apart from the page, complies.
This is the same capability leap we flagged with agentic AI threats: the risk moved from what a model says to what it does. An agent that can transact is an agent that can be robbed through its input. OWASP’s 2026 guidance continues to list prompt injection as the top driver of agentic AI security failures in production, and the payment cases are why.
Why there is no clean patch
Vendors closed specific paths in 2026, the claude:// handler among them, but the underlying condition remains because it is not a coding bug. Current models process instructions and data in the same token stream, so any content the model is asked to read can, in principle, be read as a command. You cannot fully sanitise your way out of that when the entire point of the tool is to act on arbitrary text. This is why the same class of attack recurs across every vendor and every product form, from chat apps to browsers to the analyst-targeting malware injection we covered in macOS.Gaslight.
The defensible posture is containment, not prevention. Assume injection will land, and limit the blast radius: keep agents off high-privilege actions without human confirmation, separate untrusted content from the instruction context, scope tool permissions to the minimum, and put a real approval step in front of anything irreversible like a payment or a file write. The playbook has the full control set. The 2026 field cases are simply the proof that teams shipping AI features can no longer treat prompt injection as a future problem.
Frequently asked questions
Is prompt injection actually being exploited in the wild?
Yes. In 2026 researchers documented live cases: a one-click Claude Desktop flaw, AI browsers leaking credentials, and indirect injections on real websites tricking agents into cryptocurrency payments. It is no longer only a lab demonstration.
What was the PromptFiction flaw in Claude Desktop?
PromptFiction, disclosed by Oasis Security, abused the claude:// URI scheme so a crafted link auto-submitted a hidden prompt to the agent with no review step. Chained with earlier flaws it could reach conversation exfiltration and remote code execution. Anthropic has fixed it.
Why are AI browsers especially vulnerable?
AI browsers read untrusted web content and act with the user’s authenticated session, so injected text that looks like an instruction can be executed. OpenAI has said AI browsers may always be vulnerable because the model cannot reliably tell instructions from content.
Can prompt injection steal money?
Yes. Researchers found campaigns embedding injections in malicious websites to trick autonomous agents with payment authority into sending cryptocurrency. When an agent can transact, a successful injection can direct a transfer.
Can prompt injection be patched permanently?
Not with current architectures. Models process instructions and data in the same token stream, so any content they read can be read as a command. Vendors can close specific paths, but the underlying condition persists, which is why containment matters more than prevention.
How do teams defend against it?
Limit the blast radius: keep agents off high-privilege or irreversible actions without human confirmation, separate untrusted content from the instruction context, and scope tool permissions tightly. Our prompt injection defender’s playbook covers the full control set.
Sources and further reading
- Dark Reading: Claude flaw automatically sends malicious prompts to AI agents
- Brave: Unseeable prompt injections in screenshots, more vulnerabilities in Comet and other AI browsers
- The Hacker News: New BioShocking attack tricks AI browsers into leaking user credentials
- Unit 42: Web-based indirect prompt injection observed in the wild
- SecurityWeek: Prompt injection attacks trick AI agents into making crypto payments
- TechCrunch: OpenAI says AI browsers may always be vulnerable to prompt injection
- Ransomnews: Prompt injection: the 2026 LLM defender’s playbook