Researchers at Noma Labs have disclosed SneakPeek, a high-severity flaw chain in the preview pane of Anthropic’s Claude Code Desktop that could turn a routine “have a look at this file” request into silent theft of a developer’s keys and tokens. Anthropic has fixed it, but the case shows that the riskiest part of an AI coding tool is often the ordinary software wrapped around the model.
What happened
On 14 October 2026 Noma Labs, the research team at Noma Security, published details of an exploit chain it calls SneakPeek. The weakness lived in Claude Code Desktop, the desktop edition of Anthropic’s agentic coding assistant, specifically in the panel that automatically displays any HTML file Claude has opened or changed.
Noma showed that a booby-trapped HTML file placed in a public code repository could run script in that panel without any further click or approval. The script could then read files from the developer’s machine and post them to an attacker’s server. The material at risk included SSH private keys, AWS and other cloud credentials, GitHub secrets, API keys and Claude’s own OAuth session tokens.
Anthropic rated the issue 8.7 (High) under CVSS version 4.0, and Noma says the vendor regarded the impact as comparable to running code on the host. Version 1.30096.1 of Claude Desktop, pushed via auto-update from 17 August, carries the fix. A CVE and GitHub security advisory were still pending at disclosure.
Noma reported the bug on 4 July with a working proof of concept, and Anthropic triaged it within days. Anthropic had a first patch ready for retest by 24 July, but Noma demonstrated a bypass the same day. In early August Anthropic accepted that the fix was incomplete and reworked the design before the final patch was verified.
The technical picture
Anthropic did sandbox the pane, with three layers: a Content Security Policy blocking scripts, an opaque origin keeping rendered pages away from local files, and a request filter meant to stop disk reads. Each layer had a gap, and the gaps lined up.
- A size threshold changed the rules. Smaller HTML files were loaded inline with the strict script-blocking policy applied. Files above 256KB were written to a temporary location and opened from disk instead, and on that path the policy never applied.
- The origin was too generous. Content loaded from disk in Chromium, which powers Electron apps such as Claude Code Desktop, can reach other local files rather than being boxed into an isolated origin.
- The filter was asleep. The request filter worked when the pane was proxying a running development server, but not when it rendered a static file straight from disk, such as a test coverage report.
Noma’s demonstration repository looked like a normal project, complete with a large coverage report, which would not look odd to anyone. Asking Claude to look at that report was enough. Because Electron exposes the full set of browser web APIs, data could leave quietly with no permission prompt.
The patch bypass is the most instructive detail. Anthropic first blocked file reads from the main page, but Noma shifted them into a Web Worker, a background thread the patch did not cover, forcing the deeper fix. As Eli Ainhorn, senior AI vulnerability researcher at Noma, put it to CSO Online, “The protections were real, they just didn’t cover every path.”
Why it matters for UK organisations
AI coding assistants have moved quickly from experiment to everyday tooling in UK software houses, banks, public sector digital teams and the managed service providers that support them. Their laptops typically hold exactly what SneakPeek targeted: SSH keys, cloud access keys and source control tokens. One compromised workstation can become a route into cloud tenancies, build pipelines and customer environments.
The delivery method is also uncomfortable. Cloning a public repository and asking an assistant to explain it is now a standard way to evaluate a library. Nothing about that would look suspicious, and the agent’s own logs might show nothing wrong. Sysdig’s Crystal Morin told CSO Online that the file reads and outbound connections would only be visible at the runtime layer.
There is a governance angle too. Under UK GDPR, an attacker walking off with credentials that unlock personal data is a reportable risk, not a theoretical one. Boards approving AI coding tools should be asking how those tools are patched, which machines they run on and what secrets those machines hold.
Expert view
What strikes me most is that the model itself did nothing wrong here. Claude read a file it was asked to read. The damage came from a rendering component behaving like a browser with its safety catch off. When we test Electron applications, the same weaknesses recur: inconsistent security policies between code paths, unexpected local file access, and filters that only engage in some modes. SneakPeek has all three.
It also exposes a blind spot in how many organisations think about “AI security”. A lot of effort is going into prompt injection defences and model guardrails. Those matter, but this attack never needed to fool the model. In my experience, the less glamorous plumbing around an AI tool, such as previewers, extensions and local servers, gets far less scrutiny than the model, and attackers will follow the path of least resistance.
Credit is due to both sides on the disclosure. Anthropic engaged quickly, accepted the bypass and reworked the design rather than adding another narrow block. The lesson for defenders is unchanged: assume the next tool has a similar gap and limit what any single compromise can reach.
What to do now
- Confirm the version. Check that every installation of Claude Desktop is on 1.30096.1 or later and that auto-update has not been disabled by device policy. This maps to the Cyber Essentials security update management control.
- Inventory AI coding tools. Find out which assistants, desktop apps and extensions developers are actually running, including unofficial ones. You cannot patch what you have not listed.
- Get long-lived secrets off laptops. Replace static cloud keys and broad personal access tokens with short-lived, scoped credentials issued through single sign-on, and store SSH keys in hardware or an agent with confirmation prompts. This supports the Cyber Essentials user access control requirements.
- Treat untrusted repositories as untrusted code. Review unfamiliar public projects in a disposable virtual machine or container that holds no real credentials.
- Watch the runtime, not just the agent. Use endpoint detection to flag unexpected reads of credential files and unusual outbound connections from developer tools, and test that those alerts actually fire.
- Harden configuration. Apply secure configuration baselines to developer endpoints, and restrict outbound traffic from build and development machines where practical.
Bottom line
SneakPeek has been patched through auto-update since August. The wider point stands: AI coding assistants inherit every weakness of the desktop software they run in, and they sit on machines full of valuable secrets. UK organisations should keep these tools updated, shrink what a developer laptop can unlock, and monitor the endpoint as closely as they monitor the model.
Sources
- Noma Labs: SneakPeek: How the Preview Pane in Claude Code Desktop Can Exfiltrate Your Data
- CSO Online: How Claude Code’s 256KB blind spot put developers’ secrets in the preview pane
- PR Newswire: Noma Labs Uncovers Critical Security Vulnerabilities in Claude Code Desktop App (CVSS 8.7)
- Dark Reading: Anthropic ‘SneakPeek’ Flaw Is a Silent Zero-Click Threat
