Noma Labs found a high-severity Claude Code Desktop flaw that let malicious HTML files steal local credentials and private keys through the preview pane.
Noma Labs researchers discovered a high-severity vulnerability in Anthropic’s Claude Code Desktop application that allowed malicious HTML files to steal credentials and private keys from a developer’s machine. The flaw, named SneakPeek, received a CVSS score of 8.7.
How the Exploit Worked
The vulnerability, discovered by Norma Labs’ senior vulnerability researcher Eli Ainhorn, affected Claude Code Desktop’s preview pane, which uses Electron’s Chromium-based rendering engine to display HTML files when Claude reads or modifies them.
The researcher found three security weaknesses that worked together to bypass the preview’s protections. Files smaller than 256KB were loaded as data: URLs with a Content Security Policy (CSP) blocking JavaScript execution. Larger files were instead loaded through file:// URLs, where the CSP was not applied. The request filter also failed to block local file access when Claude rendered a static HTML file directly from disk.
Noma Labs demonstrated the attack using a public repository containing a code coverage report with malicious JavaScript hidden inside it. A developer who cloned the repository and asked Claude to review or edit the report could trigger the payload when the preview pane opened the file. The script then ran without a separate permission prompt.
It could read sensitive local files using fetch(), including SSH private keys, AWS credentials, GitHub and npm tokens, Docker registry credentials, Git identity information, Kubernetes credentials, and Claude OAuth tokens. The script sent the stolen data to an attacker-controlled server using the navigator.sendBeacon() API.
The finding highlights how a routine code-review task could expose sensitive development credentials without a separate permission prompt.
Initial Patch and Final Fix
Noma Labs reported the vulnerability to Anthropic on July 4, 2026. Anthropic triaged it on July 9 and assigned a CVSS v4.0 score of 8.7.
On July 24, Anthropic deployed an initial patch blocking direct fetch() and XMLHttpRequest requests to file:// paths. However, Noma Labs researchers demonstrated a bypass the same day by moving file-reading requests into Web Workers created from blob: URLs. The workers could still read sensitive files and pass their contents to the main thread for exfiltration.
Anthropic confirmed the incomplete fix on August 3. According to Noma Labs, the company addressed the remaining issues in Claude Desktop version 1.30096.1 and later, with the update delivered through automatic updates on August 17.
At the time of the researchers’ report, a CVE assignment and GitHub Advisory publication were still pending.
Experts’ Commentary
Cybersecurity experts who shared their comments with Hackread.com said SneakPeek highlights the risks posed by AI tools that process untrusted files, particularly when those tools operate on developer machines containing sensitive credentials.
Crystal Morin, Senior Cybersecurity Strategist at Sysdig, said, “SneakPeek is an unfriendly reminder that AI tools come with their own attack surface.” She added, “Most AI security centers on the model: training, safety filters, and system prompts. SneakPeek wasn’t a model failure, it lived in the application around it.”
Morin also highlighted the visibility challenge for defenders, explaining that “The malicious script executed in the preview pane’s rendering process, not as an action the agent took, so agent-level logs would not be expected to show it.”
Ram Varadarajan, CEO at Acalvio, said, “Three seemingly minor gaps chained together to steal AWS credentials and SSH keys without a click. And Noma’s first-patch bypass makes the bigger point: no single layer of prevention is going to hold forever.”
He recommended using decoy credentials to detect potential compromise, saying, “Plant model-aware decoy credentials on developer machines and along paths AI agents can reach. If an agent, whether well-behaved or compromised, touches one, you get a high-confidence alert, even if you don’t yet know the vulnerability being exploited.”
