The Attack That Needs Zero Clicks
Noma Labs disclosed a vulnerability chain on October 14, 2026 that should make every team using Claude Code Desktop sit up straight. Called SneakPeek, the flaw let an attacker read arbitrary files from a developer's machine — SSH keys, cloud credentials, API tokens — with a single poisoned HTML file sitting in a public repo.
No phishing email. No social engineering. No "are you sure?" dialog. You clone a repo, ask Claude to look at a coverage report, and your secrets are already en route to an attacker's server. The preview pane did the rest.
Anthropic shipped a fix in Claude Desktop 1.30096.1, delivered via auto-update. If your instance auto-updated in mid-August 2026 or later, you're covered. If you pinned an older version or your update channel is flaky, read on.
Why 256KB Changed Everything
The preview pane in Claude Code Desktop uses two rendering paths for HTML files. Files under 256KB get rendered as data: URLs with a restrictive Content Security Policy applied. JavaScript is blocked. Safe enough.
Files above that threshold? They get written to disk and loaded via file:// URLs — and that path had no CSP at all.
Three compounding design flaws lived in that larger-file path. First, the missing CSP meant JavaScript executed without restriction. Second, file:// URLs granted same-origin access to the entire local filesystem — every file readable by the Claude Desktop process. Third, there was zero isolation between the preview rendering context and the host filesystem.
So the exploit becomes trivial: craft an HTML file, pad it past 256KB with whitespace or comments, embed a JavaScript payload, and drop it in a repo. The size threshold wasn't arbitrary, it's a practical threshold for coverage reports, test output, and dashboard files that developers routinely inspect.
The Delivery Is the Scary Part
The mechanism that makes SneakPeek genuinely dangerous isn't the file size trick. It's the workflow integration.
Here's what the developer does: clone a public repository. Ask Claude to review a file. That's it. Claude reads the file. The preview pane renders it automatically as part of its normal workflow. The payload fires.
There's no prompt asking permission. No warning banner. The entire chain, clone, ask, read, render, exfiltrate, happens silently as a side effect of a routine code review request. Noma Labs' proof-of-concept disguised the malicious HTML as a code coverage report, the kind of file you'd expect to find in a repo's CI output directory.
The payload reads sensitive files (SSH private keys, AWS credentials, API tokens) and exfiltrates them to an attacker-controlled endpoint via sendBeacon(). The developer never sees anything suspicious. The tool just... worked.
The Patch That Wasn't
Anthropic took the disclosure seriously from day one. They triaged it, scored it CVSS 8.7 (High) under CVSS v4.0, and shipped a patch within twenty days that blocked direct fetch() and XMLHttpRequest calls to file:// paths from the renderer process.
Solid response. Except it wasn't enough.
Noma Labs came back with a bypass the same day the patch landed. By moving the fetch() call into a Web Worker created from a blob: URL, the request originated from a context the CSP filter didn't cover. The Worker read the same sensitive files and posted them back to the main thread, which exfiltrated them via sendBeacon(). All three original defects, no CSP, same-origin access, no isolation, remained fully exploitable through this alternative path.
This is the part that should bother security teams. The initial fix was reactive and narrow. It patched the specific code path shown in the proof-of-concept without addressing the architectural problem. The bypass wasn't exotic; any engineer familiar with Web Workers and blob URLs could have found it.
The Real Fix
After Noma's bypass demonstration, Anthropic confirmed the fix was incomplete and moved the report back to Triaged status. The comprehensive solution required changes across three axes: enforce CSP on the file:// rendering path, modify how files above the size threshold are loaded (eliminating the privilege granted by file:// URLs), and isolate the Worker context so it can't sidestep request filters.
The definitive patch shipped August 17, 2026 in Claude Desktop 1.30096.1 and later versions. Anthropic closed the vulnerability after final retest confirmed all issues were resolved.
The full disclosure timeline tells the story:
- July 4, Initial report with full PoC submitted to Anthropic
- July 9, Triaged, CVSS 8.7 (High) assigned
- July 24, First patch deployed; Noma reports bypass same day
- August 3, Bypass confirmed, fix marked incomplete
- August 17, Comprehensive fix shipped
- October 2026, Public disclosure
Six weeks from report to complete fix. The partial fix that shipped in between gave researchers time to find the bypass, but it also gave a false sense of security to anyone who checked for an update and saw one had landed.
What This Means for Your Team
The SneakPeek chain isn't unique to Claude Code Desktop. It's a pattern: AI-powered development tools that automatically render or preview local files create attack surface that's invisible to the developer using them. The tool isn't compromised. The workflow isn't malicious. The trust boundary is just... wrong.
A few practical takeaways for engineering leaders:
Update aggressively. Claude Desktop's auto-update is your primary defense here. If you've disabled or delayed updates for stability reasons, you're leaving a window open for every zero-day that ships in the desktop shell. The gap between "patch available" and "developer actually running the patch" is the window attackers exploit.
Audit what your tools automatically render. SneakPeek worked because the preview pane rendered HTML files without asking. If your AI coding tools auto-render, auto-execute, or auto-load files as part of their normal workflow, that's a surface you need to evaluate. The same class of vulnerability could exist in other tools, Cursor, VS Code extensions, or any Electron-based development environment.
Treat local file access as a security boundary. The file:// URL granting same-origin access to the entire filesystem was the root architectural flaw. Any desktop tool that reads files you don't explicitly trust needs sandboxing that accounts for this. Sandboxing that only applies to small files is not sandboxing.
Check your versions. If you're running Claude Desktop older than 1.30096.1, you are vulnerable to a publicly documented exploit chain. This isn't a theoretical risk anymore. Noma Labs published the full technical details on October 14, 2026. The cat is out of the bag.
The broader pattern here matters. AI coding assistants are gaining more integration into developer workflows, reading files, rendering previews, executing commands, accessing terminals. Each integration point is a potential trust boundary violation. SneakPeek was one of the first to weaponize a preview pane, but it won't be the last.
