“Claudy Day” Flaws Allow Data Theft via Fake Claude AI Ads, Report

Oasis Security disclosed a chained attack dubbed "Claudy Day" against Anthropic's Claude: hidden HTML in pre-filled chat URLs enables prompt injection, malicious Google Ads (via an open redirect) delivers targets through trusted-looking links, and the Anthropic Files API can be abused to quietly exfiltrate large amounts of stolen data; the prompt injection was patched after responsible disclosure.