A poisoned HTML file was all it took to turn Claude Code Desktop's preview pane into a potential data-exfiltration channel. Researchers found that malicious JavaScript could bypass the app's safeguards and steal developers' credentials without triggering a permission prompt.

Security researchers at Noma Labs discovered SneakPeek, a vulnerability in Anthropic's Claude Code Desktop that could let attackers read sensitive files on a developer's computer and send their contents to a remote server. Anthropic rated the flaw 8.7 out of 10 under the CVSS v4.0 scoring system, classifying it as a high-severity issue.

The attack starts with an ordinary-looking public code repository. An attacker hides malicious JavaScript inside an HTML file disguised as a code coverage report, which developers commonly use to measure the percentage of their source code executed during automated testing.

The victim clones the repository and asks Claude Code to review or edit the report. Claude then renders the HTML file in its preview pane, triggering the malicious code without asking the user for additional permission.

Noma Labs found that the attack could bypass all 3 layers of defense protecting Claude Code's preview pane. A Content Security Policy (CSP) blocks script execution, origin isolation limits what rendered content can access, and a request filter controls which resources the renderer can fetch.

The researchers found that HTML files larger than 256KB followed a different rendering path, allowing malicious JavaScript to execute without the expected CSP protections. They also bypassed the request filter's local-file restrictions.

When Anthropic patched the direct file-reading route, the researchers found another way around the fix using a Web Worker and a blob: a URL.

By exploiting these weaknesses, the researchers could extract files containing secrets like SSH private keys, AWS access keys and secrets, npm and GitHub auth tokens, and send them to an attacker-controlled server without requiring the victim to approve a separate permission request.

Anthropic has released a comprehensive fix to address the bypass, which is available in Claude Code Desktop v1.30096.1.

AI coding tools under attack

SneakPeek isn't the first security issue reported in Claude Code. In another case, a researcher accused Anthropic of quietly fixing 2 vulnerabilities in the tool's network sandbox without properly informing users. The flaws could have allowed attackers to bypass network restrictions and potentially steal credentials, source code, and internal data.

Zooming out, SneakPeek highlights a broader problem with AI coding tools: their security depends on more than just their models' ability to spot malicious inputs. If the app isn’t properly secured, even a feature that does little more than display a preview can become an entry point for attackers.

In a recent report on attacks against AI agents hooked up with GitHub Actions, researchers demonstrated how malicious instructions hidden in pull request data could trick agents from Anthropic, Google, and Microsoft into revealing secrets like API keys and access tokens.