Noma Labs discovered a high-severity Claude Code Desktop flaw that permit malicious HTML recordsdata steal native credentials and personal keys by means of the preview pane.
Noma Labs researchers found a high-severity vulnerability in Anthropic’s Claude Code Desktop utility that allowed malicious HTML recordsdata to steal credentials and personal keys from a developer’s machine. The flaw, named SneakPeek, acquired a CVSS rating of 8.7.
How the Exploit Labored
The vulnerability, found by Norma Labs’ senior vulnerability researcher Eli Ainhorn, affected Claude Code Desktop’s preview pane, which makes use of Electron’s Chromium-based rendering engine to show HTML recordsdata when Claude reads or modifies them.
The researcher discovered three safety weaknesses that labored collectively to bypass the preview’s protections. Information smaller than 256KB had been loaded as knowledge: URLs with a Content material Safety Coverage (CSP) blocking JavaScript execution. Bigger recordsdata had been as a substitute loaded by means of file:// URLs, the place the CSP was not utilized. The request filter additionally failed to dam native file entry when Claude rendered a static HTML file instantly from disk.
Noma Labs demonstrated the assault utilizing a public repository containing a code protection report with malicious JavaScript hidden inside it. A developer who cloned the repository and requested Claude to assessment or edit the report may set off the payload when the preview pane opened the file. The script then ran with out a separate permission immediate.
It may learn delicate native recordsdata utilizing fetch(), together with SSH personal keys, AWS credentials, GitHub and npm tokens, Docker registry credentials, Git identification info, Kubernetes credentials, and Claude OAuth tokens. The script despatched the stolen knowledge to an attacker-controlled server utilizing the navigator.sendBeacon() API.
The discovering highlights how a routine code-review activity may expose delicate growth credentials with out a separate permission immediate.
Preliminary Patch and Closing Repair
Noma Labs reported the vulnerability to Anthropic on July 4, 2026. Anthropic triaged it on July 9 and assigned a CVSS v4.0 rating of 8.7.
On July 24, Anthropic deployed an preliminary patch blocking direct fetch() and XMLHttpRequest requests to file:// paths. Nonetheless, Noma Labs researchers demonstrated a bypass the identical day by shifting file-reading requests into Net Staff created from blob: URLs. The employees may nonetheless learn delicate recordsdata and go their contents to the primary thread for exfiltration.
Anthropic confirmed the unfinished repair on August 3. Based on Noma Labs, the corporate addressed the remaining points in Claude Desktop model 1.30096.1 and later, with the replace delivered by means of computerized updates on August 17.
On the time of the researchers’ report, a CVE project and GitHub Advisory publication had been nonetheless pending.
Specialists’ Commentary
Cybersecurity specialists who shared their feedback with Hackread.com stated SneakPeek highlights the dangers posed by AI instruments that course of untrusted recordsdata, significantly when these instruments function on developer machines containing delicate credentials.
Crystal Morin, Senior Cybersecurity Strategist at Sysdig, stated, “SneakPeek is an unfriendly reminder that AI instruments include their very own assault floor.” She added, “Most AI safety facilities on the mannequin: coaching, security filters, and system prompts. SneakPeek wasn’t a mannequin failure, it lived within the utility round it.”
Morin additionally highlighted the visibility problem for defenders, explaining that “The malicious script executed within the preview pane’s rendering course of, not as an motion the agent took, so agent-level logs wouldn’t be anticipated to point out it.”
Ram Varadarajan, CEO at Acalvio, stated, “Three seemingly minor gaps chained collectively to steal AWS credentials and SSH keys with out a click on. And Noma’s first-patch bypass makes the larger level: no single layer of prevention goes to carry perpetually.”
He really useful utilizing decoy credentials to detect potential compromise, saying, “Plant model-aware decoy credentials on developer machines and alongside paths AI brokers can attain. If an agent, whether or not well-behaved or compromised, touches one, you get a high-confidence alert, even for those who don’t but know the vulnerability being exploited.”
