Anthropic’s Claude Code Desktop application has been found vulnerable to a serious security exploit that could allow attackers access to a developer's machine and sensitive credentials. A recent investigation by Noma Security revealed this flaw, which they have labeled "SneakPeek", exposes how the integration of emerging technologies can reshape security challenges in software development.
The critical issue stems from the application’s automated preview pane, which processes HTML files created by or uploaded to Claude Code. In circumstances where a developer reviews an HTML document containing embedded malicious JavaScript, that script could execute without additional user prompt. This could potentially lead to the extraction of sensitive files from the developer's local environment, including AWS credentials, GitHub secrets, and SSH private keys.
“This demonstrates how attackers can exploit trust across AI ecosystems, targeting the relationships formed between models, agents, and the services they connect with,” said Ronald Lewis, head of cybersecurity governance at Black Duck. In a blog post shared with CSO, Noma explained how an attacker might plant a malicious file within a public repository, waiting for a developer to trigger a review in Claude Code.
Upon rendering the manipulated HTML file, the malicious script has the ability to access local files and transmit sensitive data to a remote server, raising alarms about the potential risks of AI tools in development environments.
Analyzing the SneakPeek Vulnerability
The SneakPeek flaw has been assigned a high severity CVSS score of 8.7. Although a CVE ID is forthcoming, Anthropic cooperated with Noma Labs during the disclosure process and indicates that they have resolved the issue, according to Eli Ainhorn, a senior AI vulnerability researcher at Noma.
“Anthropic confirmed they are preparing a GitHub Security Advisory and have requested a CVE for it,” Ainhorn mentioned, highlighting the seriousness with which the company is treating this exploit. The implications of this vulnerability originate from three key architectural weaknesses in the application’s HTML preview mechanism.
Firstly, there's a file-size threshold affecting how HTML documents are processed. Files smaller than 256KB are encoded in base64, limiting script execution via strict Content Security Policies (CSP). Conversely, larger files are directly loaded as "file://" URLs, bypassing those safety measures.
This leads to the second issue: when larger files load via the "file://" protocol, they can access the local filesystem within Chromium, unlike smaller files which are confined to a secure, isolated environment. Lastly, Noma discovered that an inactive request filter intended to block "file://" access remained unengaged during instances of static file rendering, leaving the application vulnerable. “Relying on size-based thresholds or client-side filters for security assumptions is fragile,” Lewis noted.
The consequences of infiltrating a developer's workstation are substantial, as critical operational secrets like SSH keys and cloud configuration data are often stored there. Noma identified that an initial patch issued by Anthropic could indeed be bypassed. By relocating the file-reading code to a Web Worker—essentially a background thread—the file access manipulated by attackers circumvented the patch's protections.
Security Risks Beyond AI Models
The execution of malicious scripts occurs within the preview pane’s rendering process rather than through actions by the AI model. This casts doubt on the effectiveness of security controls that many organizations may assume are sufficient for protecting AI workflows. As Ainhorn pointed out, “The protections were in place; they just didn't cover every potential exploit pathway.”
Organizations need to remain vigilant, regularly updating AI coding tools and mitigating risks through the use of scoped, short-lived tokens instead of permanent credentials. This proactive stance could significantly limit what could potentially be exfiltrated during such an exploit.
Crystal Morin, a senior cybersecurity strategist at Sysdig, emphasized the importance of monitoring at the runtime level, as logs generated at the AI agent level might not capture all activity. “The endpoint is where AI agents start, but their impact can reach far beyond just local systems,” she cautioned, signifying the far-reaching implications of these vulnerabilities on cloud infrastructure and data security.
