With no prompt, no click, and no sandbox defenses, a high-severity bug in Anthropic’s Claude Code Desktop lets an adversary steal deeply sensitive files from software developer machines.
It’s patched now, but it wasn’t easy.
The first fix for the vulnerability, dubbed “SneakPeek,” was bypassed by Noma researchers who first discovered the bug. That sent Anthropic’s team back into the code to make deeper architectural fixes. Anthropic and Noma collaborated on the disclosure and fix, according to the Noma researchers.
The vulnerability impacts Claude Code Desktop’s automated preview pane, which provides coders with real-time previews of HTML files the platform has generated or modified. Three specific flaws in the preview’s architecture, when chained together, bypassed all built-in sandbox protections that developers using the platform assumed were in place, according to Noma. The three specific gaps researchers identified included missing content security policy, unrestricted origin access, and inactive request filtering.
“An attacker could deploy a standard-looking public code repository containing an HTML file padded past 256KB with an embedded malicious script,” Eli Ainhorn, senior AI vulnerability researcher at Noma, wrote in the report. “When a developer asked Claude Code to review or edit the file, the preview pane rendered the document automatically, triggering silent background exfiltration of credentials.”
The malicious script could then steal AWS and GitHub credentials, API keys, and Claude’s own OAuth tokens, along with any others on the host machine — all without an interaction from the developer believing they are working in a protected, sandboxed environment.
AI Models Struggle with Security
There are likely to be more of these stealth vulnerabilities occurring in environments assumed to be secure, like Claude’s Code Desktop preview sandbox, according to Ainhorn.
“I think the announcement from Satya (Nadella) this week on X, and Anthropic’s statement today, in addition to vulnerabilities we’ve been seeing over the past few months, all point clearly in that direction.”
Ainhorn is referring to Microsoft CEO Nadella’s article calling for an AI cybersecurity “emergency brake” and guidance to “treat models as compromised,” as well as Anthropic’s ominous study showing bots can self-replicate to form future AI worm attacks through makeshift IoT device networks.
“The companies you rely on to create and supply the model cannot also be your security provider,” Ainhorn adds. “Or they can provide a baseline, but they can’t be relied on to be your only security provider.”
The “SneekPeek” vulnerability was first reported to Anthropic on July 4, and the company pushed out a fix on July 9, according to Noma’s timeline. After a July 24 re-test, Noma found a bypass, and a final patch was deployed on Aug. 17 ahead of this month’s advisory.
The best protections include an aggressive, automated patching program, and a refinement of developer behaviors, according to Ainhorn.
“Coding applications need to be kept updated, and long-lived credentials need to be kept off developer machines,” Ainhorn says, “but robust security solutions that provide both holistic visibility and runtime protection are no longer nice to have, they have become the de facto standard for every company with autonomous agents in production.”
