Claude Desktop’s synced Personal Preferences feature can be exploited as a covert prompt-injection vector, transforming the AI assistant into a de facto command-and-control (C2) agent.
This method allows for remote code execution on a compromised user workstation without the need for phishing emails or traditional malware delivery.
In this attack chain, the initial access is obtained through a third-party email aggregation platform that centralizes customer inboxes into a single management interface.
By exploiting weaknesses in the authentication flow, attackers can access thousands of actively used inboxes belonging to real users. They can then pivot into associated services, including Claude accounts, through magic links or password resets.
Claude AI Prompt Injection Attack
Once an attacker has control of a victim’s Claude account, the key target becomes the Personal Preferences field. This is a user-configurable prompt that outlines behavioral instructions such as tone, workflows, and custom guidance, and it is automatically synced across all devices and sessions associated with the account, including Claude Desktop.
Accordin to Pentera, the researchers created a malicious prompt-injection payload that encodes detailed logic for enumerating tools, executing commands, and establishing fallback behavior.
This payload is embedded into the Personal Preferences field through the compromised web session, appearing as an opaque blob rather than clear-text malicious instructions. This minimizes detection by human reviewers or automated audits.
When the victim later opens Claude Desktop, the synced Personal Preferences silently load the injected payload. This payload begins by enumerating installed extensions, integrations with the Management Control Plane (MCP), tools, and other command-capable components.
If a local command-execution extension, such as Desktop Commander, is present, the injected logic instructs Claude to run that tool in the background while continuing to respond to the user’s visible queries.
This allows the execution of attacker-controlled shell commands, such as inspecting the environment, listing directories, and sending outbound curl requests to a remote server.
This setup creates a persistent, remotely controlled C2 loop in which each user interaction can trigger Claude to fetch and execute updated Bash payloads from the attacker’s infrastructure, effectively weaponizing the assistant as a stealthy system agent unknowingly driven by the victim.
If no command-capable extension is installed, the injected prompt shifts to a social-engineering mode: it directs Claude to display a realistic, workflow-aligned error message, complete with error codes, links, and step-by-step instructions that persuade the user to install a specific command-capable extension, like Desktop Commander, under the pretense of resolving the “issue.”
Because the message appears to originate from a trusted assistant in a familiar user interface, users are more likely to comply. Once they do, subsequent interactions can trigger the execution, granting the attacker full control of the host.
The impact of this attack varies depending on the user profile. On developer or DevOps workstations, attackers can harvest SSH keys from home directories, extract cloud credentials from configuration paths (such as AWS and gcloud profiles), access kubeconfigs, CI/CD tokens, and local source code repositories, enabling lateral movement into production infrastructure and internal services.
For non-technical endpoints, they can hijack browser sessions, extract saved passwords, access internal documents, and impersonate the user on collaboration platforms, using the compromised assistant as both an execution layer and a social-engineering channel within the organization.
The researchers disclosed their findings to Anthropic in November 2025. Anthropic acknowledged the risk but stated that Personal Preferences, skills, and MCP connectors are considered features designed to execute code and, in their current threat model, do not represent an in-scope vulnerability. However, they indicated that enhancements to address the reported risks are on their roadmap.
Interact with Cyber Threats in Windows, Linux, macOS VMs to Trigger Full Attack Chain - Analyse Malware & Phishing with ANY RUN
 agent.){kind=link}