- Noma Labs showed that Claude Code Desktop's preview pane could run an attacker's script and read local files, including SSH keys and cloud credentials, after a routine review request.
- Anthropic scored it CVSS 8.7 and needed two rounds to fix it. The full fix is in version 1.30096.1 and later, with a CVE still pending.
- Check that developers are on the fixed version, and keep long-lived credentials off their machines.
When the AI reads a file, the file gets to act
Developers have long learned not to open strange files. A coding assistant changes the habit. The developer now asks the assistant to look, and the assistant opens the file on their behalf.
That is the idea behind SneakPeek, a flaw Noma Labs found in Claude Code Desktop. The risky step was no longer the human opening a file. It was the tool rendering one. The lesson for leaders is that an assistant's built-in viewer is part of the attack surface, even though nobody put it on a risk register.
What Noma Labs found
Claude Code Desktop includes a preview pane. It is a panel inside the app that shows an HTML page the moment Claude has read or changed it, with no extra step from the developer. Noma Labs found that a booby-trapped file could run JavaScript there and read files from the developer's machine.
The researchers built a demo repository that looked like a normal project, with source files, tests and a coverage report. A coverage report shows how much of the code the tests exercise. They padded the report past 256KB and hid a script in it.
The attack needs a victim to clone the repository and ask Claude to look at the report. After that, Noma says, no permission prompt appears. The pane renders the file, and the script runs. Noma says the script could quietly take the keys developers use to log in to servers (SSH private keys), their cloud credentials and other API keys. It could also take the sign-in tokens that Claude itself holds. The script could also learn the victim's real IP address.
Dark Reading describes the flaw as needing "no prompt, no click." Strictly, one routine request is still needed. But that request is exactly what developers do all day.
How three small gaps became one big hole
Anthropic built three defenses around the preview. A Content Security Policy, a browser rule that blocks scripts, stopped JavaScript from running. A special web address format gave the page an opaque identity, so it could not reach local files. A request filter watched outbound requests.
Noma found that each defense covered only one path. Files under 256KB load in the protected way. Larger files are written to a temporary file and loaded from a file:// address. That path never received the script-blocking rule. In Chromium, the browser engine inside the app, a page loaded this way can read other local files.
The request filter had a similar hole. It was active when the pane showed a running development server. It did not engage when the pane drew a static file from disk, as with a coverage report.
The script then sent the stolen data out with navigator.sendBeacon(), a standard web feature that posts data in the background. Claude Code Desktop is built on Electron, which runs a full Chromium browser. Noma says the app had no policy restricting outbound requests, so nothing stopped the upload.
The first fix did not hold
Noma reported the flaw on July 4. Anthropic scored it on July 9 and later patched it. The patch blocked file:// reads by fetch() and XMLHttpRequest in the main page.
The sources differ on when that patch shipped. Noma's timeline puts the patch and a retest request on July 24. Dark Reading dates the fix to July 9.
On July 24, Noma showed a bypass. It moved the read into a Web Worker, a background script started from a blob: address, which the patch did not cover.
Anthropic confirmed on August 3 that the fix was incomplete. The complete fix arrived on August 17 as an automatic update. Claude Desktop versions 1.30096.1 and later carry it. Noma credits Anthropic with a transparent and responsive process. A GitHub advisory and CVE ID were still pending when Noma published. The sources report a researcher demonstration, not attacks in the wild.
What to ask your teams
First, confirm that developer machines run Claude Desktop 1.30096.1 or later. Auto-update should have done this, but check rather than assume.
Second, ask what sits on those machines. Eli Ainhorn, the Noma researcher quoted by Dark Reading, advises keeping long-lived credentials off developer machines. A stolen key that expires quickly does far less harm.
Third, treat agent tools as software that opens untrusted content. Ask which files your coding assistants render or run on a developer's behalf, and what those tools can reach.
Ainhorn also told Dark Reading that a model vendor cannot be a company's only security provider. The vendor can set a baseline. Your own monitoring has to cover the rest.
The sandbox was real, and it had three layers. It still failed because each layer assumed a different path. Ask your vendors which paths their protections assume.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Noma Security.
