SneakPeek bug let repo HTML previews in Claude Code Desktop read and exfiltrate local files

On October 14, Noma Labs published details of SneakPeek, an exploit chain targeting the preview pane in Claude Code Desktop. According to a dev.to write-up of the findings, a maliciously enlarged HTML file placed in a public repository could execute JavaScript the moment Claude previewed it, read files from the user's home directory, and send them to an attacker-controlled server. Anthropic rated the issue CVSS 8.7, High, and shipped a complete fix on August 17.

How the attack worked

When Claude reads or edits an HTML file, the desktop app renders it in a preview pane. Noma Labs describes three safeguards around that pane: a Content Security Policy that blocked scripts, loading pages as data: URLs so they had an opaque origin, and a request filter attached to the dev-server proxy.

Each safeguard covered only part of the surface. Files under 256KB were loaded as data: URLs with the CSP applied. Files over that threshold were written to a temporary location and opened as file:// URLs, a route that never received the CSP — and in Chromium, a file:// page can fetch other local files. The request filter, meanwhile, only ran while the pane proxied a live dev server, not when it displayed a static file from disk.

The exploit therefore only needed bulk. Noma Labs padded an HTML document past 256KB, embedded a script in it, and disguised it as a test coverage report — a file nobody would find suspicious at that size. A victim who cloned the repository and asked Claude to review the report triggered the script without a single permission prompt, because the agent never ran a command or wrote a file; the code executed in the application's renderer purely as a side effect of showing the file. The proof of concept reportedly extracted SSH private keys, AWS keys, npm and GitHub tokens, and Docker and Kubernetes credentials.

A first patch, then a bypass

Noma Labs reported the bug on July 4. Anthropic's initial patch blocked fetch() and XMLHttpRequest calls to file:// targets from the previewed page. Noma Labs defeated it by moving the same fetch into a Web Worker created from a blob: URL, a context the filter did not cover, and reported the bypass on July 24. On August 3 Anthropic acknowledged the first fix was incomplete and began a comprehensive rework addressing the CSP, the file:// loading path, and the Worker loophole. It shipped on August 17 in Claude Desktop 1.30096.1 and later, distributed via auto-update, so users whose apps update themselves have been protected for roughly two months.

The bypass itself is the instructive part, the dev.to author argues: the first patch blocked the specific APIs the proof of concept had used, and the attacker simply reached for another. The final fix targeted the underlying conditions instead of the individual calls.

Lessons for tools that render repositories

The post's author, who builds a code-reading IDE called Reado, draws broader conclusions from the bug. The 256KB cutoff was most likely a performance decision, but a size threshold quietly routed large files down a second code path with a different security model. The agent-permission machinery — command approval, write restrictions, shell sandboxing — was never involved, since the attack lived in the application around the agent, not in anything Claude did. And the trigger was a review request, the moment when a file is least likely to have been vetted by anyone the user trusts, handled by one of the most capable surfaces in the app.

The author also describes auditing their own tool after reading the disclosure and finding two related flaws in its embedded browser pane, both now fixed.

Why it matters

SneakPeek shows that the attack surface of agentic coding tools extends well beyond the agent. Security effort has concentrated on constraining what the model can do, yet here the agent behaved entirely innocently while a file from a cloned repository exfiltrated credentials through the UI. Anything that renders repository content — previews, Markdown, notebooks, images, embedded browsers — is reachable by an attacker regardless of how tightly the agent is governed.

For users, the practical step is confirming Claude Desktop is on version 1.30096.1 or later; the GitHub advisory and CVE identifier were still listed as pending at the time of the write-up. For builders, the guidance is to treat every file in a clone as input from a stranger, keep one rendering path with identical restrictions regardless of file size, restrict based on where content comes from rather than which APIs it might call, and show source by default, rendering only what is necessary.