Security firm Noma Security’s research team, Noma Labs, has disclosed a vulnerability it calls “SneakPeek” in Claude Code Desktop, Anthropic’s desktop app for its AI coding assistant. Noma says Anthropic rated the flaw 8.7 on the CVSS severity scale, which counts as High, and has fixed it.
No source claims the flaw was exploited in real attacks.
How the attack worked
When Claude reads or edits an HTML file, the app shows it automatically in a preview pane. That pane was meant to be sandboxed, with a content security policy (CSP), a set of rules that blocks scripts from running.
According to Noma’s write-up, published on 14 October 2026, the protection had gaps. Files under 256KB were loaded in a way that applied the CSP, but “because Claude’s preview pane loads files above 256KB via file:// URLs, the payload gets same-origin access to the victim’s entire local filesystem”. Larger files got no CSP at all. A filter meant to block reads of local files was also not active when the app displayed a static HTML file from disk.
Noma demonstrated the attack with a poisoned code-coverage report placed in a public code repository. A developer clones the repository and asks Claude to update the report. When the preview pane renders the file, hidden code runs, reads files such as SSH private keys and cloud credentials, and quietly sends them to the attacker’s server. Noma says the victim does not have to approve anything beyond the original request.
A first fix, then a bypass
According to Noma, Anthropic’s first patch blocked the preview from reading local files directly. Noma then got around it. “By moving the file-reading code into a Web Worker, a background thread that browsers run separately from the main page, the requests originated from a context the patch didn’t cover,” Eli Ainhorn, a senior AI vulnerability researcher at Noma, told CSO Online.
Noma’s timeline says it reported the flaw on 4 July 2026, Anthropic rated it on 9 July, the bypass was reported on 24 July and confirmed on 3 August, and Anthropic issued a full fix on 17 August in Claude Desktop 1.30096.1 and later, delivered by automatic update.
Ainhorn told CSO that Anthropic is preparing a GitHub security advisory and has requested a CVE, a public identifier for the flaw. Both are still pending. Anthropic did not immediately respond to CSO’s request for comment.
“Organizations need to keep AI coding tools updated, stop leaving long-lived credentials on developer machines, and use scoped, short-lived tokens where possible,” Ainhorn told CSO.
What this means
- Update the app. Noma says the fix arrived by auto-update from Claude Desktop 1.30096.1.
- Previews can be an attack path. The risk came from the app’s rendering, not from the AI model.
- Protect developer machines. Long-lived credentials on laptops are a prime target.
Sources
- Noma Labs (Eli Ainhorn), “SneakPeek: How the Preview Pane in Claude Code Desktop Can Exfiltrate Your Data”, 14 October 2026. https://noma.security/noma-labs/sneakpeek-how-the-preview-pane-in-claude-code-desktop-can-exfiltrate-your-data
- Noma Security, “Noma Labs Uncovers Critical Security Vulnerabilities in Claude Code Desktop App (CVSS 8.7)”, PR Newswire, 14 October 2026. https://www.prnewswire.com/news-releases/noma-labs-uncovers-critical-security-vulnerabilities-in-claude-code-desktop-app-cvss-8-7-302908539.html
- CSO Online (Shweta Sharma), “How Claude Code’s 256KB blind spot put developers’ secrets in the preview pane”, 14 October 2026. https://www.csoonline.com/article/4235139/how-claude-codes-256kb-blind-spot-put-developers-secrets-in-the-preview-pane.html
Related stories
- AI Agent Security, 8 October (Evening): Disputed AgentCore Research, Claude Code’s Fail-Closed Hooks and Malware Aimed at AI Analysts
- Chainguard Launches Three Tools to Keep AI Coding Agents Contained, Checked and Hunting for Bugs
- AI Agent Security: Langflow’s Critical Flaw, Copilot’s Encrypted-Instruction Finding and the New Guardrails
- Anthropic Launches the Anthropic Cyber Mission: Critical-Infrastructure Programme and Free Open-Source Scanner
