With no prompt, no click, and no sandbox defenses, a high-severity bug in Anthropic's Claude Code Desktop lets an adversary steal deeply sensitive files from software developer machines.
It's patched now, but it wasn't easy.
The first fix for the vulnerability, dubbed "SneakPeek," was bypassed by Noma researchers who first discovered the bug. That sent Anthropic's team back into the code to make deeper architectural fixes. Anthropic and Noma collaborated on the disclosure and fix, according to the Noma researchers.
The vulnerability impacts Claude Code Desktop's automated preview pane, which provides coders with real-time previews of HTML files the platform has generated or modified. Three specific flaws in the preview's architecture, when chained together, bypassed all built-in sandbox protections that developers using the platform assumed were in place, according to Noma. The three specific gaps researchers identified included missing content security policy, unrestricted origin access, and inactive request filtering.
"An attacker could deploy a standard-looking public code repository containing an HTML file padded past 256KB with an embedded malicious script," Eli Ainhorn, senior AI vulnerability researcher at Noma, wrote in the report. "When a developer asked Claude Code to review or edit the file, the preview pane rendered the document automatically, triggering silent background exfiltration of credentials."
The malicious script could then steal AWS and GitHub credentials, API keys, and Claude's own OAuth tokens, along with any others on the host machine — all without an interaction from the developer believing they are working in a protected, sandboxed environment.