Claudy Day: a three-flaw chain in claude.ai

In March 2026, researchers at Oasis Security published an attack chain they called Claudy Day, assembled from three separate flaws in claude.ai and the wider claude.com platform, and showed how the three combine into one pipeline: a paid Google ad that displays a claude.com address, an invisible instruction hidden in a pre-filled chat link, and a route out of Claude's sandbox that ends at the attacker's own Anthropic account. The chain required no integration, no tool and no MCP server — Oasis says it worked against a default, out-of-the-box claude.ai session, with the user's conversation history and memory as the target. No source read for this article reports the chain being used against a real person, and the archive records no real harm: Oasis demonstrated it and reported it to Anthropic before publishing. The archive files the disclosure as a high-severity, undisputed incident dated to March 2026 at month precision, and it sits in the Orca AI Incident Archive alongside the rest of its prompt-injection entries.

What the three flaws did

The first flaw was an injection you could not see. claude.ai lets a link open a new chat with a prompt already filled in, through the URL parameter claude.ai/new?q=… Oasis found that certain HTML tags could be embedded in that parameter and would remain invisible in the text box while still being processed by Claude once the user pressed Enter. The person clicking would read one prompt; Claude would act on that prompt plus whatever the attacker had buried in the markup, including instructions to gather data and move it.

The second flaw was the exit. Claude's code-execution sandbox restricts outbound network access, but it allowed connections to api.anthropic.com. Oasis found that this alone was enough to leave with the data: by embedding an API key belonging to the attacker inside the hidden instructions, the researchers got Claude to search the user's conversation history for sensitive material, write it to a file and upload that file to the attacker's Anthropic account through the Files API, where the attacker could list it and read it at leisure. Expert Insights describes the Files API as a file-upload beta feature of the platform at the time. CPO Magazine adds the framing the researchers used to get the model to cooperate: the request was presented as a lesson about the Files API, the attacker's key was described as a dummy that was not expected to work, and the victim's earlier conversations were offered up as sample content for the lesson. No integration and no external tool was needed at any point.

The third flaw was the way in. Any URL under the path claude.com/redirect/ forwarded the visitor without validating the target it was given, including to third-party domains. Google Ads validates an advertiser's URL by hostname, so an ad could display a claude.com address, pass that validation, and still deliver the click wherever the attacker chose — in this case to a claude.ai/new?q= link carrying the hidden instructions. Oasis put the result plainly: "Not a phishing email. A Google search result, indistinguishable from the real thing." The same write-up notes that Google's ad targeting could narrow delivery by location, industry and demographics, or reach named individuals through Customer Match on email addresses, turning a broad lure into a targeted one.

What the attacker could actually reach

In a bare claude.ai session, the material available is the conversation history and whatever Claude's memory holds. Oasis lists what that means in practice: summarising earlier conversations to build a profile of the user, pulling specific threads on named subjects such as an upcoming merger or a medical concern, or simply letting the agent decide for itself which parts look sensitive and dumping those. The researchers stress that this is not a marginal data set — it is the accumulation of months of personal and business questions typed into a general-purpose assistant.

The blast radius changes with configuration. Where MCP servers, tools or enterprise integrations are enabled, the same injected prompt can read files, send messages, reach APIs and act inside any connected service, and the extracted material leaves by the same route. Oasis's specific criticism is about timing rather than mere availability: those tools are reachable from the very first interaction, with no confirmation step, so a single injected prompt can use them before the user has had a chance to notice anything.

What is established, and what was only demonstrated

Established: Oasis Security, a vendor of agentic access management and therefore an interested party, published the research and a technical report in March 2026; Dark Reading, TechRadar, CPO Magazine and Expert Insights carried the same three-part description without contradicting it; the flaws were reported to Anthropic through its Responsible Disclosure Program before publication; Anthropic fixed the prompt-injection flaw, and Expert Insights reports that Anthropic confirmed the patch. No CVE identifier appears in Oasis's write-up, in its technical report page, or in any of the coverage read for this article — the disclosure ran through the vendor's programme rather than a numbered advisory.

Not established: that anyone was attacked. CPO Magazine states that the researchers developed the chain independently and "do not note any observations of it being used in the wild", and no account read for this piece describes a victim, a stolen conversation or a count of exposed accounts. The archive records real harm as false. The ad-buying step is the delivery route the researchers identified and described; nothing in the record shows a campaign that ran it. Anthropic has not published a standalone advisory on the chain, so the fix status reaches readers secondhand, through Oasis and the outlets that repeated Oasis.

One point where the accounts diverge

CPO Magazine describes the exfiltration step slightly differently from Oasis, as the injection sending the extracted text to the Anthropic Messages API so the attacker can read it from their own API logs, rather than as a file uploaded through the Files API. Dark Reading and Expert Insights follow Oasis's version: a file written in the sandbox, uploaded to api.anthropic.com under the attacker's key, then listed and read from the attacker's account. The difference is which part of Anthropic's API surface the data lands in; all three accounts agree on the property that made the chain work, which is that api.anthropic.com was the one outbound destination the sandbox permitted.

What changed afterwards

Oasis's own status statement is narrow. The prompt-injection issue has been fixed, and the remaining issues — the open redirect and the Files API route — were "currently being addressed" when the research was published, a formulation repeated in its FAQ and in the coverage that followed. Oasis praised Anthropic's responsiveness and did not publish a timeline for the outstanding items. The recommendations the researchers gave were correspondingly concrete: sanitise URL-based prompt inputs rather than trusting the parameter, audit what a code sandbox is allowed to reach, and require explicit user approval before tools are used on a first prompt.

For the open redirect there is at least one later data point. A request made for this article on 4 November 2026 to the claude.com/redirect/ path with an unrelated external target returned a redirect to claude.ai's home page rather than to the target — consistent with the flaw having been closed, though it is a single observation and not a statement from Anthropic. The claude.ai/new?q= parameter could not be tested the same way, because automated requests to that path are refused.

Why the record is dated March 2026

The Oasis page carries a May 2026 update stamp next to its March 2026 publication date, which is enough to make later references place the disclosure in May. The archive dates the record to March 2026 at month precision and does not assert a day, and both Dark Reading and TechRadar carry March 2026 publication dates of their own. The month is the finest unit the record commits to, and this article keeps to it.

The archive marks the entry as a landmark, and the tags it assigns — IPI for the injection, EXFIL for the channel — describe the two halves of the finding accurately. What makes the case worth keeping is the third element: the delivery flaw lived in a different part of the same company's web estate from the model, and it is what turned a prompt-injection technique into something that could be aimed at a named person through an ordinary search ad. Oasis cites its own earlier OpenClaw disclosure, published in February 2026, as the previous example of the same pattern — an agent compromised by one manipulated input, with identity controls that were never designed for it.