High-Severity Flaw in Claude Code Desktop Exposed Developer Credentials
Researchers at Noma Labs uncovered a critical vulnerability, dubbed SneakPeek, in Anthropic’s Claude Code Desktop application, allowing attackers to steal local credentials and private keys via malicious HTML files. The flaw, assigned a CVSS score of 8.7, exploited weaknesses in the app’s preview pane, which uses Electron’s Chromium-based engine to render files.
How the Exploit Worked
The attack leveraged three security gaps in Claude’s preview functionality:
- Small files (<256KB) loaded as
data:URLs with a Content Security Policy (CSP) blocking JavaScript. - Larger files loaded via
file://URLs, bypassing CSP restrictions. - A request filter failure that allowed direct access to local files when rendering static HTML.
A proof-of-concept demonstrated how a developer cloning a malicious repository containing a booby-trapped code coverage report could trigger the exploit when Claude previewed the file. The embedded JavaScript executed silently, extracting sensitive data such as:
- SSH private keys
- AWS credentials
- GitHub/npm tokens
- Docker/Kubernetes credentials
- Claude OAuth tokens
Stolen data was exfiltrated to an attacker-controlled server via navigator.sendBeacon().
Patch Timeline & Bypass
Noma Labs reported the flaw to Anthropic on July 4, 2026, with the company triaging it by July 9. An initial patch on July 24 blocked direct fetch() and XMLHttpRequest calls to file:// paths, but researchers bypassed it the same day using Web Workers from blob: URLs to read files and relay data.
Anthropic confirmed the incomplete fix on August 3 and released a full patch in Claude Desktop v1.30096.1, deployed via automatic updates on August 17. A CVE assignment and GitHub Advisory were pending at the time of disclosure.
Expert Insights
Cybersecurity professionals emphasized the risks of AI tools processing untrusted files. Crystal Morin of Sysdig noted that SneakPeek was an application-layer flaw, not a model failure, and highlighted detection challenges since the exploit ran in the preview pane’s rendering process, evading agent-level logs.
Ram Varadarajan of Acalvio warned that minor security gaps could chain into severe breaches, advocating for decoy credentials to detect unauthorized access. The incident underscores the need for robust security in AI-assisted development environments.
Source: https://hackread.com/claude-code-desktop-flaw-html-steal-credentials/
Anthropic cybersecurity rating report: https://www.rankiteo.com/company/anthropicresearch
"id": "ANT1792175024",
"linkid": "anthropicresearch",
"type": "Vulnerability",
"date": "7/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'customers_affected': 'Developers using Claude Code '
'Desktop',
'industry': 'Artificial Intelligence / Software '
'Development Tools',
'name': 'Anthropic',
'type': 'Company'}],
'attack_vector': 'Malicious HTML files in repository previews',
'data_breach': {'data_exfiltration': 'Yes (via navigator.sendBeacon() to '
'attacker-controlled server)',
'file_types_exposed': 'HTML, code coverage reports',
'personally_identifiable_information': 'Potentially '
'(developer identities '
'tied to credentials)',
'sensitivity_of_data': 'High (SSH keys, cloud credentials, '
'OAuth tokens)',
'type_of_data_compromised': 'Credentials, private keys, '
'tokens'},
'date_detected': '2026-07-04',
'date_resolved': '2026-08-17',
'description': 'Researchers at Noma Labs uncovered a critical vulnerability, '
'dubbed SneakPeek, in Anthropic’s Claude Code Desktop '
'application, allowing attackers to steal local credentials '
'and private keys via malicious HTML files. The flaw exploited '
'weaknesses in the app’s preview pane, which uses Electron’s '
'Chromium-based engine to render files. A proof-of-concept '
'demonstrated how a developer cloning a malicious repository '
'could trigger the exploit when Claude previewed a '
'booby-trapped file, extracting sensitive data such as SSH '
'private keys, AWS credentials, GitHub/npm tokens, '
'Docker/Kubernetes credentials, and Claude OAuth tokens.',
'impact': {'brand_reputation_impact': 'Moderate (AI-assisted development tool '
'security flaw)',
'data_compromised': 'SSH private keys, AWS credentials, GitHub/npm '
'tokens, Docker/Kubernetes credentials, Claude '
'OAuth tokens',
'identity_theft_risk': 'High (exposure of PII and credentials)',
'operational_impact': 'Potential unauthorized access to developer '
'systems and cloud services',
'systems_affected': 'Claude Code Desktop application'},
'investigation_status': 'Resolved',
'lessons_learned': 'The incident highlights the risks of AI tools processing '
'untrusted files and the need for robust security in '
'development environments. Minor security gaps can chain '
'into severe breaches, and application-layer flaws in '
'Electron-based apps require careful scrutiny.',
'post_incident_analysis': {'corrective_actions': ['Full patch in Claude '
'Desktop v1.30096.1',
'Automatic updates for '
'affected users'],
'root_causes': ['Weaknesses in Claude’s preview '
'pane (Electron-based rendering)',
'Request filter failure allowing '
'direct access to local files',
'Incomplete initial patch '
'(bypassed via Web Workers)']},
'recommendations': ['Implement stricter sandboxing for file previews in '
'Electron apps',
'Use decoy credentials to detect unauthorized access',
'Enhance monitoring for unusual data exfiltration '
'patterns',
'Regularly audit third-party dependencies and preview '
'functionalities'],
'references': [{'source': 'Noma Labs Research'},
{'source': 'Sysdig (Crystal Morin)'},
{'source': 'Acalvio (Ram Varadarajan)'}],
'response': {'containment_measures': 'Initial patch blocking direct fetch() '
'and XMLHttpRequest calls to file:// '
'paths',
'recovery_measures': 'Automatic updates for affected users',
'remediation_measures': 'Full patch in Claude Desktop v1.30096.1 '
'(deployed August 17, 2026)'},
'title': 'High-Severity Flaw in Claude Code Desktop Exposed Developer '
'Credentials',
'type': 'Vulnerability Exploitation',
'vulnerability_exploited': 'SneakPeek (CVE pending, CVSS 8.7)'}