SneakPeek is a high-severity vulnerability in Anthropic’s Claude Code Desktop, disclosed by Noma Labs on October 14, 2026. It chained three weaknesses in the app’s HTML preview pane so that a malicious HTML file padded past 256KB could silently read a developer’s SSH private keys, AWS credentials, GitHub tokens, and API keys, then send them to an attacker’s server. No click, no prompt, no permission request. Anthropic rated the flaw CVSS 8.7 (high) and shipped the final fix in build 1.30096.1 on August 17, before the research went public. If you use Claude Code Desktop, update to the latest build and check the steps below.
What SneakPeek is
Claude Code Desktop is Anthropic’s desktop app for its coding assistant. When you ask it to review or edit an HTML file, it shows a live preview in a built-in pane, the same way a code editor shows you a web page you are building. Developers assumed that pane was sandboxed, and for most files it was: scripts were blocked by a Content Security Policy, the rendered page was isolated from the local filesystem, and a request filter controlled what the renderer could fetch.
SneakPeek, discovered by Noma Labs senior AI vulnerability researcher Eli Ainhorn, is the name for what happened when those protections quietly fell away. The research showed that HTML files larger than 256KB followed a different rendering path: instead of being loaded safely from memory, they were loaded straight from disk with full local filesystem access. A script hiding inside such a file could execute without the expected protections and read anything on the machine.
That detail is what turned an ordinary preview into a credential-stealing channel. Anthropic treated the impact as equivalent to code execution on the host machine.
How the attack worked
The scenario Noma demonstrated reads like a normal workday, which is exactly why it is dangerous:
- An attacker publishes a harmless-looking public repository. Inside it sits an HTML file padded past 256KB, disguised as a code coverage report, the boring HTML files developers generate to see which lines of code their tests exercise. Hidden in the file is malicious JavaScript.
- A developer clones the repository and asks Claude Code to review the report or edit it. Nothing about this is unusual.
- The preview pane renders the file automatically. Because the file exceeds 256KB, it takes the disk-based rendering path: full filesystem access, no script-blocking policy, and no active request filtering.
- The hidden script reads local credential files and exfiltrates them to an attacker-controlled server using a background web request, entirely silently.
At no point does the developer click anything, approve anything, or see anything wrong. The theft happens as a side effect of asking the assistant to look at a file, something developers do dozens of times a day.
The three broken layers
Most secure systems rely on defense in depth: if one layer fails, the next one catches the attack. SneakPeek defeated all three layers protecting the preview pane at once:
- A missing Content Security Policy. On the oversized-file path, the Content Security Policy that normally blocks script execution was not applied, so embedded JavaScript ran freely.
- Unrestricted origin access. The rendered page was served from a file:// origin with access to the local filesystem, so the script could reach files far outside the previewed document.
- Inactive request filtering. The request filter that should have limited what the renderer could fetch was not functioning on this path, so the script could send stolen data out to a remote server.
Any one of those gaps, left alone, might have been survivable. Together, they gave a script in a previewed page the same power as malware installed on the machine.
The first fix failed
What happened next is a useful lesson in how hard this class of bug is to kill. Noma reported SneakPeek to Anthropic on July 4. Anthropic shipped a first fix on July 9. Then, on July 24, Noma found a way around it.
The bypass worked by blocking the direct file-reading route Anthropic had closed, then going around it: the researchers showed they could reach the same data through a Web Worker combined with a blob URL, another rendering path the first patch had not accounted for. Anthropic had to make deeper architectural changes to the preview pane itself, and the final patch was deployed on August 17, reaching users through auto-update in build 1.30096.1.
The researchers and Anthropic collaborated on the disclosure and the fix, and the public research only appeared in October, after the fix had been in users’ hands for nearly two months.
Who is affected and what to do right now
Anyone running an unpatched build of Claude Code Desktop was exposed, specifically developers who previewed untrusted HTML files. The good news: no exploitation in the wild has been reported, and the fix has been available since August. The checklist is short:
- Update Claude Code Desktop to build 1.30096.1 or later. Auto-update should have delivered it, but verify the version yourself.
- Treat repository HTML as untrusted. Do not ask any coding assistant to preview HTML files from repositories you would not run code from.
- Prefer short-lived credentials. Keep long-lived cloud and source-control credentials off developer workstations where possible, as Noma recommends, so a stolen file buys an attacker hours, not months.
- Rotate if you were exposed. If you previewed untrusted HTML with an older build, rotate your SSH keys, AWS credentials, GitHub tokens, and npm tokens as a precaution.
There is no CVE number yet; Noma said publication of a CVE and a GitHub advisory was pending at disclosure time.
Why SneakPeek matters beyond Claude Code
This is not really a story about one app. Every AI coding assistant with a rendering surface, a preview pane, a canvas, a browser tool, faces the same design pressure: developers want to see rich output instantly, and rich output is a browser, which means it needs browser-grade isolation. A feature that does nothing more than display a file can become an entry point if the sandbox around it has a hole.
It is also a reminder that developer machines are high-value targets. SSH keys, cloud credentials, and tokens sitting in home directories are the keys to production infrastructure, which is why supply-chain style attacks keep aiming at the development workflow. SneakPeek joins a growing list of incidents where the attack went through the tools developers trust: the GhostAction supply chain wave that turned GitHub Actions into a credential-stealing machine and the Tensorlake npm compromise that harvested developer tokens through a poisoned package both targeted the same prize, just through different doors.
For Anthropic specifically, the timing is awkward. The company has been on a disclosure-heavy run this month, from its October 9 disclosure of agent misuse incidents to the Anthropic Cyber Mission security initiative launched a week earlier. SneakPeek adds a product-security chapter to that story, and a caution that has been reported separately: a researcher previously accused Anthropic of quietly fixing two vulnerabilities in the tool’s network sandbox without properly informing users.
Frequently asked questions
What is SneakPeek?
SneakPeek is a high-severity vulnerability (CVSS 8.7) in Anthropic’s Claude Code Desktop, discovered by Noma Labs and disclosed October 14, 2026. It chained a missing Content Security Policy, unrestricted origin access, and inactive request filtering in the app’s HTML preview pane, letting a poisoned HTML file larger than 256KB silently steal developer credentials with no user interaction.
What could attackers steal with SneakPeek?
In Noma’s tests, a script in a previewed HTML file could exfiltrate SSH private keys, AWS access keys, GitHub and npm authentication tokens, Kubernetes credentials, API keys, and Claude’s own OAuth tokens from the host machine, sending them to an attacker-controlled server.
Has SneakPeek been exploited in the wild?
No exploitation in the wild has been reported. The vulnerability was reported privately to Anthropic on July 4, 2026, and the final fix shipped August 17, nearly two months before public disclosure.
Which version fixes SneakPeek?
Claude Code Desktop build 1.30096.1 and later, delivered via auto-update. Noma’s first fix on July 9 was bypassed on July 24 using a Web Worker and blob URL, so only the August 17 architectural fix is complete.
What should Claude Code Desktop users do?
Confirm you are on build 1.30096.1 or later, avoid previewing HTML from untrusted repositories, prefer short-lived credentials on workstations, and rotate long-lived keys if you previewed untrusted HTML with an older build.