The attack path centres on Claude Desktop’s Personal Preferences feature, which allows users to set account-wide instructions that are synchronised across sessions and devices. Security researchers showed that if an attacker gains access to a victim’s Claude account, malicious instructions can be planted in those preferences and later invoked when the user interacts with Claude Desktop.
The technique does not rely on a conventional malware attachment, a phishing link or a vulnerability in the underlying language model. Instead, it abuses the trust relationship between the assistant, the user’s synced settings and installed command-capable tools. Where such tools are already present, Claude can be induced to identify available execution routes and use them during an apparently normal conversation.
The proof-of-concept attack began with access to a third-party email aggregation inbox linked to the victim’s account. From there, the attacker was able to reach the Claude account and modify the user’s personal preferences. The injected payload was encoded, making it appear as an unreadable but harmless text block rather than a clear instruction set. Once synchronised to Claude Desktop, the preference acted as a persistent prompt-injection vector.
Researchers involved in the test said the attack could instruct Claude to enumerate local tools capable of running commands. If a tool such as Desktop Commander or a similar Model Context Protocol connector was installed, the assistant could execute attacker-directed commands on the machine. If no such tool existed, the payload could simulate a plausible error message and nudge the user into installing one, widening the route to compromise.
The finding underscores a shift in the threat model around AI assistants. Traditional endpoint security is designed to detect suspicious binaries, malicious scripts or unusual network activity. Agentic AI systems create a different exposure because they can translate text into actions, use approved tools and operate inside workflows the user already trusts. The malicious component may therefore be an instruction rather than a file.
The researchers framed Claude Desktop as a possible command-and-control intermediary once an attacker controls the account-level instruction layer. The assistant would not need to behave like classic malware. It could act through the same local permissions and connectors the user had previously authorised, making the boundary between legitimate assistance and hostile automation harder to enforce.
Anthropic has repeatedly warned that prompt injection remains a core risk for AI systems that read untrusted content and use tools. Its security guidance stresses that Claude Code and related agentic products operate within permissions granted by users and that commands should be reviewed carefully before approval. The latest demonstration, however, shows that account-level preferences can become part of the attack surface when they are treated as trusted, persistent context.
The episode also follows a series of security disclosures involving AI coding and desktop assistants. Separate research this year showed how agentic coding tools could be manipulated through repository files, hidden instructions and tool configurations to trigger command execution or expose credentials. Academic work has likewise warned that persistent memory and personalisation features can allow poisoned instructions to survive beyond a single session.
Security teams are paying particular attention to the Model Context Protocol ecosystem because MCP tools can connect assistants to files, browsers, terminals, calendars, databases and business applications. These integrations are valuable for productivity but expand the blast radius of a prompt-injection failure. A low-risk data source can become dangerous when it is chained to a high-risk executor.
The Claude Desktop attack is not being described as mass exploitation in the wild. It also requires important preconditions, including account access and, for direct execution, a local connector with command-running capability. That limits the immediate scale of the risk. The concern for enterprises is that many organisations are rapidly deploying AI assistants without the same governance applied to endpoint management, privileged access and software supply chains.
Also published on Medium.
Follow Arabian Post
Select Arabian Post as your preferred source on Google and MSN News for trusted business news and Arab politics and updates.
