Security research team Noma Labs, part of Noma Security, released details of SneakPeek, an exploit chain discovered in Anthropic’s Claude Code Desktop application. Rated CVSS 8.7 (High), the vulnerability let attackers silently run arbitrary JavaScript and exfiltrate sensitive local host data, including API keys, cloud credentials, SSH keys, and OAuth session tokens, by tricking the application’s preview pane into rendering a poisoned file.
Following a collaborative disclosure process, Anthropic released a comprehensive, multi-layered security update that fully resolves all identified attack vectors.
The Anatomy of the Exploit
The vulnerability centers on Claude Code Desktop’s automated preview pane, an Electron-based Chromium rendering panel designed to show real-time previews of HTML files generated or modified by Claude. Noma Labs discovered three architectural gaps that, when chained together, completely bypassed the application’s built-in sandbox defenses:
- Missing Content Security Policy (CSP): While files under 256KB were converted to base64 data: URLs with strict CSP script blocking, files exceeding 256KB were written to disk and loaded directly as file:// URLs, bypassing CSP script-execution protections entirely.
- Unrestricted Origin Access: Loading as a file:// URL granted the preview renderer direct local filesystem access in Chromium, rather than restricting it to an isolated opaque origin.
- Inactive Request Filtering: The request filter intended to block file:// access remained inactive during static file rendering (such as local code test reports), allowing unrestricted reads across the victim’s host filesystem.
An attacker could deploy a standard-looking public code repository containing an HTML file padded past 256KB with an embedded malicious script. When a developer asked Claude Code to review or edit the file, the preview pane rendered the document automatically, triggering silent background exfiltration of credentials like -‘/.aws/credentials, -‘/.ssh/id_ed25519, and Kubernetes cluster configurations back to an attacker’s server via standard browser APIs (navigator.sendBeacon).
Collaborative Patching and Worker Bypass Discovery
During the coordinated disclosure timeline, Anthropic initially deployed a patch blocking standard fetch() and XMLHttpRequest calls to file:// origins. However, Noma Labs researchers identified an immediate bypass by executing background file-read requests inside a Web Worker spawned from a blob: URL, circumventing the initial filter.
Anthropic subsequently implemented further remediation to deploy a permanent, comprehensive fix across all execution contexts and rendering paths.
“Safely advancing frontier AI requires a model of mutual responsibility where security researchers and AI platforms collaborate transparently,” said a Noma Labs researcher. “Anthropic’s commitment to iterating on every bypass until achieving a comprehensive, layered defense exemplifies the industry standard needed to keep the software development ecosystem safe.”
Disclosure Timeline
- July 4, 2026: Noma Labs submits initial report and Proof of Concept (PoC) to Anthropic.
- July 9, 2026: Anthropic triages report, assigns CVSS 8.7 (High), and deploys initial renderer mitigation.
- July 24, 2026: Anthropic requests retest; Noma Labs demonstrates a secondary bypass via blob: URL Web Workers.
- August 5, 2026: Anthropic confirms worker bypass and initiates complete architectural fix.
- August 17, 2026: Final security patch verified and deployed; vulnerability formally marked resolved.
- October 2026: Advisory and CVE posted.
