PulseAugur
EN
LIVE 18:34:47

Claude Code Desktop vulnerability allows data exfiltration via preview pane

By PulseAugur Editorial · [3 sources] ·

Noma Labs has identified a critical vulnerability in Anthropic's Claude Code Desktop application, dubbed SneakPeek. The exploit allows malicious HTML files, disguised as code coverage reports and exceeding 256KB, to bypass three layers of sandboxing. This enables arbitrary file reading and exfiltration of sensitive data such as SSH keys, AWS credentials, and API tokens from a user's local machine without any user interaction or warning. Anthropic has rated the vulnerability with a CVSS score of 8.7 and has released a fix, though an initial patch was bypassed before a more robust architectural solution was implemented. AI

IMPACT This vulnerability highlights the security risks associated with AI-powered developer tools and the need for robust sandboxing and timely patching.

RANK_REASON Discovery of a security vulnerability in a specific software product.

Read on HN — claude cli stories →

AI-generated summary · Google Gemini · from 3 sources. How we write summaries →

Claude Code Desktop vulnerability allows data exfiltration via preview pane

How we ranked this

Signal score
0 / 100
Composite score across the factors below. Higher = stronger signal that this story matters right now.
Newsworthiness bucket
Tool
Discovery of a security vulnerability in a specific software product.
Source corroboration
3 independent sources
Multiple independent publishers reporting the same story raises confidence that it's real and newsworthy.
Topics
product, safety
Editorial topic classification. Feeds into how the story surfaces on /topic/<slug> hub pages and into the per-entity coverage mix.
AI-industry relevance
High
Clearly on-topic for AI-industry coverage.
Story freshness
26 days old
Aged out of breaking-news scoring windows; ranking reflects the durable signal from the full source set.
Coverage growth since scoring
+1 source(s) since last score
New sources have picked up this story since our last re-score. Score will update on the next scoring pass.

Full methodology in our editorial standards.

COVERAGE [3]

  1. HN — claude cli stories TIER_1 English(EN) · wondersky ·

    Claude Code Desktop Vulnerability: Preview Pane Data Exfiltration

  2. dev.to — Anthropic tag TIER_1 English(EN) · Rohit Bhadani ·

    The Claude Code Desktop Vulnerability That Beat Three Layers of Sandboxing

    <p>On October 14, 2026, Noma Security disclosed a Claude Code Desktop vulnerability called SneakPeek that let a malicious HTML file read SSH keys, AWS credentials, and GitHub tokens from a developer's machine with no click and no warning. Anthropic rated it CVSS 8.7 and shipped t…

  3. Mastodon — mastodon.social TIER_1 English(EN) · [email protected] ·

    Claude Code Desktop’s preview pane could let malicious HTML steal SSH keys, cloud credentials, GitHub and npm tokens. Anthropic fixed it after an initial patch

    Claude Code Desktop’s preview pane could let malicious HTML steal SSH keys, cloud credentials, GitHub and npm tokens. Anthropic fixed it after an initial patch was bypassed. Listen/Read: https:// hackread.com/claude-code-deskt op-flaw-html-steal-credentials/ # Cybersecurity # Cla…

    LINKS hackread.com/claude-code-desktop-flaw-htm…

RELATED ENTITIES

RELATED TOPICS