A vulnerability in Anthropic's Claude Code Desktop app could have allowed attackers to steal cloud credentials, GitHub secrets, and SSH private keys simply by tricking developers into reviewing a malicious HTML file, according to a finding published Wednesday by Noma Security. The flaw, dubbed SneakPeek, exploited the application's automated preview pane to execute harmful JavaScript without any additional action from the user. Anthropic has since fully patched the issue, which received a high-severity CVSS score of 8.7.
The vulnerability stemmed from three architectural weaknesses in how Claude Code Desktop's preview mechanism handled HTML content through its Electron-based Chromium rendering panel. Files smaller than 256KB were converted to base64-encoded data URLs with a strict Content Security Policy that prevented script execution, while files exceeding that size were written to disk and loaded as "file://" URLs, bypassing those protections entirely. This allowed larger HTML files to access the local filesystem in Chromium rather than being confined to an isolated environment. Additionally, the application's request filter intended to block file access wasn't active during static file rendering, including when developers reviewed local code test reports. An attacker could exploit this by placing a malicious file in a public repository and waiting for a developer to ask Claude Code to inspect it—once rendered, the script could read and exfiltrate sensitive data to a remote server.
"This is a strong example of how emerging technologies are reshaping the attack surface," Ronald Lewis, head of cybersecurity governance at Black Duck, told the outlet. Attackers are increasingly targeting the AI ecosystem by exploiting the implicit trust relationships between models, agents, tools, data sources, and connected services, he said. Noma found that Anthropic's initial patch could be circumvented—by moving the file-reading code into a Web Worker, a background thread that runs separately from the main page, the requests originated from a context the patch didn't cover, according to Eli Ainhorn, senior AI vulnerability researcher at Noma. The researchers reported the bypass, prompting a deeper architectural fix before the vulnerability was fully resolved. Anthropic is preparing a GitHub Security Advisory and has requested a CVE identifier, Ainhorn added.
The malicious script executed inside the preview pane's rendering process rather than as an action performed by the AI agent itself, defeating the assumption that security controls designed for the model protect all AI workflows. Compromising a developer's local workstation serves as a direct route into corporate cloud infrastructure, Lewis warned, because development machines hold high-value operational secrets including SSH private keys, AWS credentials, Kubernetes configurations, and OAuth session tokens. According to Crystal Morin, senior cybersecurity strategist at Sysdig, agent-level logs wouldn't necessarily capture the execution—file reads and outbound network connections would instead be visible at the runtime layer, where defenders need appropriate monitoring. Organizations should keep AI coding tools updated, stop leaving long-lived credentials on developer machines, and use scoped, short-lived tokens where possible, Ainhorn said, noting that approach alone would have limited what this exploit could grab. The endpoint is where AI agents start, but their blast radius extends to the cloud, Morin added, warning that routine work with AI tools can expose credentials with consequences far beyond the workstation. As AI-assisted development becomes standard practice, security teams will need to rethink where the perimeter actually sits—not just around the model, but across every interface where code generation meets local execution. The trust developers place in AI assistants to review code may itself become the most exploitable surface of all.