‘SneakPeek’ zero-click flaw in Claude Code Desktop disclosed
Partly confirmed
Status
- Claim
Partly confirmed
- Our reporting
- Medium confidence
- Importance
- 2 of 5
- Last verified
- 15 October 2026
Your AI and this story
- GPT-6 Astra167 days after its cutoff
- Claude Opus 5.5106 days after its cutoff
- Gemini 4 Argon197 days after its cutoff
- Grok 4.7136 days after its cutoff
None of these four assistants can know about it. The closest, Claude Opus 5.5, stops 106 days before it.
Key facts
- Mechanism (Dark Reading, from Noma): three gaps in the preview’s architecture chained together (no content security policy, unrestricted origin access, inactive request filtering) bypassed the sandbox developers assumed was in place
- Attack (Noma researcher Eli Ainhorn): ‘An attacker could deploy a standard-looking public code repository containing an HTML file padded past 256KB with an embedded malicious script. When a developer asked Claude Code to review or edit the file, the preview pane rendered the document automatically, triggering silent background exfiltration of credentials’
- Data at risk: AWS and GitHub credentials, API keys, SSH private keys and Claude’s own OAuth tokens
- Timeline (Noma): reported to Anthropic July 4, 2026; fix July 9; bypass found in a July 24 re-test; final patch Aug 17; advisory published in October. Anthropic and Noma coordinated the disclosure
- Ainhorn’s comment: ‘The companies you rely on to create and supply the model cannot also be your security provider’
What happened
Noma Security’s researchers found that Claude Code Desktop rendered HTML previews automatically and without the isolation users expected. A booby-trapped file in a repository was enough: once the developer asked Claude Code to look at it, the preview executed the script and exfiltrated secrets from the machine. Anthropic patched the bug in July, Noma bypassed the patch, and a deeper architectural fix followed in August, before public disclosure in October.
Why it matters
Agentic coding tools now open untrusted repositories as a matter of routine, so their own rendering and preview features become an attack surface. Noma’s original advisory and any Anthropic advisory or CVE were not found by search at writing; the account is Dark Reading’s.
Sources
1 source from 1 site. Numbers match the chips in the text.
1 source: 1 press
Press
- Dark Reading: Anthropic ‘SneakPeek’ flaw is a silent zero-click threatdarkreading.com, press
Changes
- Filed