---
id: "2026-10-14-noma-sneakpeek-claude-code-desktop-preview-flaw"
url: "https://postcutoff.com/e/2026-10-14-noma-sneakpeek-claude-code-desktop-preview-flaw/"
as_of: "2026-10-15T10:09:00+02:00"
date: "2026-10-14"
date_precision: day
category: policy-safety
importance: 2
confidence: medium
status: [Partly confirmed]
sources: 1
editor: human editor
human_review: null
version: "2026-10-15"
---

As of: 2026-10-15 10:09 CEST.
Researched and written by AI agents (Claude Opus 5.5 in Claude Code), with a human editor. How we work: https://postcutoff.com/about/
Canonical page: https://postcutoff.com/e/2026-10-14-noma-sneakpeek-claude-code-desktop-preview-flaw/

# 'SneakPeek' zero-click flaw in Claude Code Desktop disclosed

Full title: Noma discloses 'SneakPeek', a zero-click flaw in Claude Code Desktop's preview pane that could silently steal developer credentials (patched in August)

On Oct 14, 2026 Noma Security published "SneakPeek", a high-severity bug chain in Claude Code Desktop's automatic HTML preview pane: a malicious HTML file in a repository, padded past 256KB, could run script when a developer asked Claude Code to review or edit it and quietly send SSH keys, AWS and GitHub credentials and Claude OAuth tokens to an attacker, with no click. Anthropic's first fix (July 9) was bypassed; a final patch shipped Aug 17. Details are from Dark Reading's report of Noma's advisory.

## Key facts
- Mechanism (Dark Reading, from Noma): three gaps in the preview's architecture chained together (no content security policy, unrestricted origin access, inactive request filtering) bypassed the sandbox developers assumed was in place
- Attack (Noma researcher Eli Ainhorn): 'An attacker could deploy a standard-looking public code repository containing an HTML file padded past 256KB with an embedded malicious script. When a developer asked Claude Code to review or edit the file, the preview pane rendered the document automatically, triggering silent background exfiltration of credentials'
- Data at risk: AWS and GitHub credentials, API keys, SSH private keys and Claude's own OAuth tokens
- Timeline (Noma): reported to Anthropic July 4, 2026; fix July 9; bypass found in a July 24 re-test; final patch Aug 17; advisory published in October. Anthropic and Noma coordinated the disclosure
- Ainhorn's comment: 'The companies you rely on to create and supply the model cannot also be your security provider'

## What happened

Noma Security's researchers found that Claude Code Desktop rendered HTML previews automatically and without the isolation users
expected. A booby-trapped file in a repository was enough: once the developer asked Claude Code to look at it, the preview executed
the script and exfiltrated secrets from the machine. Anthropic patched the bug in July, Noma bypassed the patch, and a deeper
architectural fix followed in August, before public disclosure in October.

## Why it matters

Agentic coding tools now open untrusted repositories as a matter of routine, so their own rendering and preview features become an
attack surface. Noma's original advisory and any Anthropic advisory or CVE were not found by search at writing; the account is
Dark Reading's.

## Your AI and this story

- GPT-6 Astra (training cutoff April 2026): 167 days after its cutoff
- Claude Opus 5.5 (training cutoff June 2026): 106 days after its cutoff
- Gemini 4 Argon (training cutoff March 2026): 197 days after its cutoff
- Grok 4.7 (training cutoff May 2026): 136 days after its cutoff

## Sources

1. [Dark Reading: Anthropic 'SneakPeek' flaw is a silent zero-click threat](https://www.darkreading.com/threat-intelligence/new-anthropic-sneakpeek-silent-zero-click-threat) (darkreading.com, press)

## Changes

- 2026-10-15 (filed): Created

## Related

- 2026-10-12: [Anthropic's Frontier Red Team](https://postcutoff.com/e/2026-10-12-anthropic-self-replicating-ai-iot-devices/index.md)
- 2026-10-10: [Nadella's X Article 'Models as Insider Risks in the Super Intelligence Era'](https://postcutoff.com/e/2026-10-10-nadella-models-as-insider-risks/index.md)