[BUG] Claude Desktop allows user to submit text not present on the screen - Pasted URL creates an auto-generated hyperlink, and modifying the visible URL doesn't modify the underlying hyperlink

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Claude told me to report this as a bug here:
I am using the lasted Claude Desktop on Windows 11.
I was answering a question and pasted a URL from a text editor into the Claude Code prompt. The URL was to an Azure function with a sensitive code key as a query param value. The prompt textbox auto-converted that URL to a clickable hyperlink. I truncated most of the URL because I was trying to tell Claude about the root URL where I planned to install a new function. When I erased most of the URL and completed my message and submitted it, Claude warned me that I just sent sensitive data into the wild and the keys should be rotated immediately. I thought, "no, I didn't," but Claude was definitely quoting portions of the original unmodified URL that I had entered. It is a bug that a user can submit something to Claude in the Desktop prompt textbox that they cannot see.
On a similar note, I can't understand why that prompt input would ever auto-convert hyperlink text to active clickable links. The text is going to Claude, not a user who would find it handy to be able to directly click into something, like in an Outlook email body.

What Should Happen?

Claude Desktop should only submit text as visible in the prompt, nothing hidden, especially when the underlying hidden metadata was created by the prompt textbox itself. Ideally, do not convert URLs into active hyperlinks. If for some reason it makes sense to you guys that URLs should be converted to active links, ensure that modification of URL text also modifies the underlying link.

Error Messages/Logs

Steps to Reproduce

1. Paste a URL with sensitive information into a text editor to ensure no underlying href exists. In my case, it was like https://foo.azurewebsites.net/app/fooFunction?code=sensitiveString.
2. Open Claude Desktop.
3. Copy the URL from the text editor into the prompt.
4. Modify the URL to remove the sensitive string. In my case, I removed everything following "app/" because I was telling Claude where I planned to install a new function.
5. Form the remainder of your question or statement and submit.
6. Claude will warn you that the sensitive information that was originally pasted was just submitted to the internet.

Claude Model

Sonnet (default)

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

Claude 1.34493.1 (255293) 2026-08-21T02:05:20.000Z

Platform

Anthropic API

Operating System

Windows

Terminal/Shell

Other

Additional Information

I was surprised not to see Claude Desktop in the Terminal/Shell dropdown. Perhaps I'm too green and it goes by a more technical name.