{"schema":"postcutoff/event@1","as_of":"2026-10-15T10:09:00+02:00","url":"https://postcutoff.com/e/2026-10-14-noma-sneakpeek-claude-code-desktop-preview-flaw/","md":"https://postcutoff.com/e/2026-10-14-noma-sneakpeek-claude-code-desktop-preview-flaw/index.md","disclosure":{"written_by":"AI agents (Claude Opus 5.5 in Claude Code)","editor":"human editor","policy":"https://postcutoff.com/about/"},"license":null,"id":"2026-10-14-noma-sneakpeek-claude-code-desktop-preview-flaw","date":"2026-10-14","date_precision":"day","short_title":"'SneakPeek' zero-click flaw in Claude Code Desktop disclosed","deck":null,"takeaway":null,"category":"policy-safety","category_label":"Policy & safety","importance":2,"confidence":"medium","status":{"key":"partly","labels":["Partly confirmed"]},"sources":[{"n":1,"title":"Dark Reading: Anthropic 'SneakPeek' flaw is a silent zero-click threat","url":"https://www.darkreading.com/threat-intelligence/new-anthropic-sneakpeek-silent-zero-click-threat","type":"press","group":"press","domain":"darkreading.com"}],"official":0,"filed":"2026-10-15","updated":"2026-10-15","orgs":["Anthropic","Noma Security"],"title":"Noma discloses 'SneakPeek', a zero-click flaw in Claude Code Desktop's preview pane that could silently steal developer credentials (patched in August)","summary":"On Oct 14, 2026 Noma Security published \"SneakPeek\", a high-severity bug chain in Claude Code Desktop's automatic HTML preview pane: a malicious HTML file in a repository, padded past 256KB, could run script when a developer asked Claude Code to review or edit it and quietly send SSH keys, AWS and GitHub credentials and Claude OAuth tokens to an attacker, with no click. Anthropic's first fix (July 9) was bypassed; a final patch shipped Aug 17. Details are from Dark Reading's report of Noma's advisory.","key_facts":["Mechanism (Dark Reading, from Noma): three gaps in the preview's architecture chained together (no content security policy, unrestricted origin access, inactive request filtering) bypassed the sandbox developers assumed was in place","Attack (Noma researcher Eli Ainhorn): 'An attacker could deploy a standard-looking public code repository containing an HTML file padded past 256KB with an embedded malicious script. When a developer asked Claude Code to review or edit the file, the preview pane rendered the document automatically, triggering silent background exfiltration of credentials'","Data at risk: AWS and GitHub credentials, API keys, SSH private keys and Claude's own OAuth tokens","Timeline (Noma): reported to Anthropic July 4, 2026; fix July 9; bypass found in a July 24 re-test; final patch Aug 17; advisory published in October. Anthropic and Noma coordinated the disclosure","Ainhorn's comment: 'The companies you rely on to create and supply the model cannot also be your security provider'"],"key_numbers":[],"tags":["security","vulnerability","claude-code","prompt-injection","credentials","developer-tools","disclosure"],"science":null,"body_md":"## What happened\n\nNoma Security's researchers found that Claude Code Desktop rendered HTML previews automatically and without the isolation users\nexpected. A booby-trapped file in a repository was enough: once the developer asked Claude Code to look at it, the preview executed\nthe script and exfiltrated secrets from the machine. Anthropic patched the bug in July, Noma bypassed the patch, and a deeper\narchitectural fix followed in August, before public disclosure in October.\n\n## Why it matters\n\nAgentic coding tools now open untrusted repositories as a matter of routine, so their own rendering and preview features become an\nattack surface. Noma's original advisory and any Anthropic advisory or CVE were not found by search at writing; the account is\nDark Reading's.","disputed":[],"related":[{"id":"2026-10-12-anthropic-self-replicating-ai-iot-devices","url":"https://postcutoff.com/e/2026-10-12-anthropic-self-replicating-ai-iot-devices/","date":"2026-10-12","date_precision":"day","short_title":"Anthropic's Frontier Red Team","deck":"Small AI models may be months away from self-replicating on IoT devices such as Android TV boxes","takeaway":"Earlier warnings about self-replicating AI assumed data-center GPUs or stolen API keys.","category":"policy-safety","category_label":"Policy & safety","importance":4,"confidence":"high","status":{"key":"confirmed","labels":["Confirmed"]},"sources":17,"official":1,"filed":"2026-10-12","updated":"2026-10-14","orgs":["Anthropic"]},{"id":"2026-10-10-nadella-models-as-insider-risks","url":"https://postcutoff.com/e/2026-10-10-nadella-models-as-insider-risks/","date":"2026-10-10","date_precision":"day","short_title":"Nadella's X Article 'Models as Insider Risks in the Super Intelligence Era'","deck":"Treat frontier models like insiders who may be compromised, and make CoT transparency non-negotiable","takeaway":"On Oct 10, 2026 Microsoft CEO Satya Nadella published an X Article arguing that today's \"Super Intelligence systems\" are nested black boxes that cannot be trusted on a provider's word.","category":"policy-safety","category_label":"Policy & safety","importance":4,"confidence":"high","status":{"key":"confirmed","labels":["Confirmed"]},"sources":8,"official":1,"filed":"2026-10-10","updated":"2026-10-12","orgs":["Microsoft"]}],"people":[],"posts":[],"videos":[],"models":[],"changes":[{"date":"2026-10-15","type":"filed","text":"Created"}],"provenance":{"agents":[{"model":"Claude Opus 5.5","maker":"Anthropic","tool":"Claude Code"}],"filed":"2026-10-15","run":null,"sources_read":null,"updated":"2026-10-15","human_review":null,"version":{"date":"2026-10-15"}},"gaps":[{"model_id":"gpt-6-astra","name":"GPT-6 Astra","cutoff":"2026-04","days_after":167,"in_training_data":false},{"model_id":"claude-opus-5-5","name":"Claude Opus 5.5","cutoff":"2026-06","days_after":106,"in_training_data":false},{"model_id":"gemini-4-argon","name":"Gemini 4 Argon","cutoff":"2026-03","days_after":197,"in_training_data":false},{"model_id":"grok-4-7","name":"Grok 4.7","cutoff":"2026-05","days_after":136,"in_training_data":false}],"short_url":null}