Oasis Discloses Claude Desktop Prompt Injection Flaw (Web Pulse, 2026)