SneakPeek: Claude Code’s preview pane exposed developer secrets

After Anthropic took its internal tests offline, which we have already covered, the new story concerns a tool many developers use every day: Claude Code Desktop. Researchers at Noma Labs (Noma Security) found a flaw, named SneakPeek, in the preview pane that displays HTML files created or modified by Claude: a crafted HTML file could run JavaScript, read local files and send them to a remote server. Anthropic fixed it, after a first attempt that the researchers managed to bypass.

Almost all technical details come from CSO Online, which saw Noma’s report ahead of its publication on 14 October; Dark Reading and Cybersecurity360 confirm the discovery, the impact and the fix.

What happened

The scenario described by Noma is simple: the attacker places a malicious HTML file in a public, legitimate-looking repository and waits for a developer to ask Claude Code to review it. When the application renders the file in the preview pane, the script runs with no further user action. Dark Reading calls it a «zero-click» threat; to be precise, according to CSO Online the request to review the file is all it takes, with no other click.

The data the script could read and exfiltrate includes SSH private keys, AWS credentials and GitHub secrets; Dark Reading also mentions Claude OAuth tokens.

The score is CVSS 8.7 (v4.0), high severity, assigned by Anthropic. As of 14 October there was no CVE yet: according to Noma, Anthropic was preparing a GitHub Security Advisory and had requested an identifier. The sources do not state which Claude Code Desktop version contains the final fix.

Technical details

The Claude Code Desktop preview uses a rendering pane based on Electron and Chromium. Noma identified three weaknesses that together formed the chain:

1. 256 KB threshold. HTML files under 256 KB were converted into base64-encoded data: URLs, with a strict Content Security Policy that blocked scripts. Larger files were instead written to disk and opened as file:// URLs, without that CSP. The attacker only had to pad the file beyond the threshold.
2. Wrong origin. Loaded through file://, the content got access to the local file system in Chromium, instead of being confined to an isolated, opaque origin.
3. Inactive filter. The application has a mechanism to block file:// access, but according to Noma it was not active during static file rendering, including when developers opened local test reports.

Anthropic’s first fix blocked file reads from the main page context. Noma bypassed it by moving the file-reading code into a Web Worker, a separate thread the fix did not cover. After the bypass was reported, Anthropic made a deeper change to the preview architecture, and according to Noma the issue is now fully resolved.

One point matters for defenders: the script ran inside the preview’s rendering process, not as an agent action. Controls designed for the model, such as tool permissions and confirmations, did not see it. According to Sysdig, quoted by CSO Online, agent logs would not necessarily record the execution either: file reads and outbound connections are visible only at the system level.

Indicative MITRE ATT&CK mapping, derived from the reported facts: T1204.002 (User Execution: Malicious File), T1552.001 (Unsecured Credentials: Credentials In Files), T1552.004 (Unsecured Credentials: Private Keys), T1005 (Data from Local System), T1041 (Exfiltration Over C2 Channel).

Impact for European and Italian companies

Developer workstations hold the keys to production: SSH access to servers, cloud credentials, repository and pipeline tokens. A single compromised workstation can open the way to the company’s cloud infrastructure and, through the repositories, to the software supply chain.

For NIS2 entities, Article 21 requires measures for supply chain security and for security in system development: AI coding assistants fall within this scope and must be inventoried, updated and governed like any other tool. The same applies to software suppliers for healthcare and public administration, who often work on third-party code and repositories.

What to do now

1. Update Claude Code Desktop to the latest version on all workstations and check that automatic updates are enabled; follow the announced GitHub Security Advisory for the fixed version and the CVE.
2. Take inventory: which machines run Claude Code Desktop or other assistants with an HTML preview, and which versions.
3. Remove long-lived credentials from workstations (~/.aws/credentials, SSH keys without a passphrase, personal tokens): use temporary, narrowly scoped credentials, as Noma also suggests.
4. Rotate credentials if, before updating, developers had Claude Code Desktop review HTML files from untrusted repositories.
5. Open third-party code in separate environments (virtual machines, containers, remote development environments without secrets), not on the workstation with production access.
6. Monitor at the system level reads of files such as ~/.ssh/id_* or ~/.aws/credentials by the application’s processes, and outbound connections to unusual destinations.

How ARXDOME helps

ARX Sentry keeps the software inventory of every computer, so you know where Claude Code Desktop is installed and which version, and it collects logs and security events from machines and firewalls: suspicious executions and blocked outbound traffic reach the SOC pages. ARX Horizon enriches every connection with the reputation of the destination addresses.

Last updated: 21 October 2026