Claude Code Desktop SneakPeek Flaw: Fixed Version and What To Do

Claude Code Desktop had a vulnerability, named SneakPeek, that let a poisoned HTML file read a developer's SSH keys, AWS credentials and GitHub tokens just because Claude was asked to look at it. Anthropic scored it CVSS 8.7 (High) and fixed it on August 17, 2026 in Claude Desktop 1.30096.1 and later, delivered by auto-update. The public disclosure came on October 14, so if your Desktop app has been updating itself you are very likely already covered. If your fleet pins versions, check today.

Last updated: October 15, 2026

Official Sources#

Neither Noma nor CSO had a published GitHub advisory or CVE ID to link at the time of writing. CSO reports that Anthropic confirmed it is preparing an advisory and has requested a CVE.

What the attack actually did#

The preview pane in Claude Code Desktop renders HTML files that Claude reads or edits, so you can see the result immediately. Per Noma, Anthropic protected that pane with three layers: a Content Security Policy that blocked scripts, a data: URL load that gave the page an opaque origin, and a request filter against file:// reads. The researchers chained three gaps to get past all of them:

1. Size threshold. Files under 256KB loaded as data: URLs with the CSP. Files over 256KB were written to a temp file and loaded as file://, which never received the CSP, so embedded JavaScript ran freely.
2. Origin. A file:// page in Chromium can read other local files through fetch().
3. Inactive filter. The request filter was active when the pane proxied a running dev server, but not when it rendered a static HTML file straight from disk, such as a coverage report.

The demo was a normal-looking repository with a coverage report padded past 256KB. The victim clones it, asks Claude to review the report, and the preview pane runs the payload. Noma lists SSH private keys, AWS keys, npm and GitHub tokens, Kubernetes credentials, Docker registry auth and Claude's own OAuth tokens as readable, with exfiltration through navigator.sendBeacon(). No permission prompt appears because the agent never takes an action; the renderer does.

Anthropic's first patch blocked fetch() and XMLHttpRequest to file:// from the main page. Noma bypassed it by moving the fetch() into a Web Worker created from a blob: URL, and Anthropic then shipped the deeper fix. That is why the fixed version is August 17 and not the July patch.

The angle: your approvals cover the agent, not the renderer#

The useful lesson is not "Anthropic had a bug". It is where the trust boundary sat. Most agent security advice, including our guide to keeping secrets away from coding agents, is about what the model can be talked into doing: a Read(.env) deny rule, a scrubbed subprocess environment, a sandbox around Bash. SneakPeek bypassed all of that because the code ran inside the app's own Chromium process, as a side effect of rendering. Sysdig's Crystal Morin, quoted by CSO, makes the same point: agent-level logs would not necessarily capture it, and file reads and outbound connections show up at the runtime layer.

Who wins and loses:

• Terminal-only users are not the audience for this specific bug, because the disclosed path is the Desktop preview renderer. General Analysis makes the same distinction: updating the CLI does not prove the Desktop app is patched.
• Teams that pin Desktop versions through MDM lose the most. Auto-update fixed this for everyone else in August; a pinned package stays vulnerable until someone advances it.
• Anyone whose laptop holds long-lived cloud credentials has the largest blast radius, and the same advice applies to every agent product, not just this one. Our comparison of coding-agent security models shows how differently the tools treat credentials on disk.

What to do on Monday#

1. Check the Desktop version. The floor is Claude Desktop 1.30096.1, per Noma. Confirm after a relaunch, since an update can be staged while the old process keeps running. For Windows fleets, General Analysis adapts this read-only inventory command from Anthropic's deployment guide:

   POWERSHELL

   Copy

   Get-AppxPackage -Name Claude | Select-Object Name, Version, PackageFullName, InstallLocation
   

2. Triage oversized HTML in repos you reviewed with an older build. The trigger was a file over 256KB. This lists candidates in a checkout without opening them in any renderer:

   Terminal

   Copy

   find . -name '*.html' -size +256k
   

   Large generated coverage reports are normal, so a hit is a reason to look at the file in a plain text editor, not proof of an attack.

3. Treat exposure as a separate question from patching. General Analysis is explicit that an old build is a reason to scope an investigation, not proof of theft, and that the August patch date does not say when a particular machine updated. If you cannot reconstruct what ran, rotating long-lived keys is cheap insurance.

4. Shrink what there is to steal. Noma's own advice, relayed by CSO: keep AI coding tools updated, stop leaving long-lived credentials on developer machines, and use scoped, short-lived tokens. The permissions guide covers the agent side of that.

5. Do not open untrusted repos with your main credentials mounted. The setup in our local sandbox comparison is the stronger default for code you did not write.

What people are actually saying#

There was no Hacker News or Reddit thread on SneakPeek when this was written, so the signal here is analyst commentary, not a crowd. Reaction in the trade press has focused on the design lesson. Black Duck's Ronald Lewis told CSO that relying on size thresholds or client-side filters for a security boundary is "inherently fragile", and that a compromised developer workstation is a direct route into corporate cloud infrastructure. Noma's Eli Ainhorn framed it more charitably: "The protections were real, they just didn't cover every path."

The counter-case is worth stating plainly. The flaw was reported on July 4, fixed on August 17 and only disclosed on October 14, so most users were protected before anyone could write an exploit from the public details. Exploitation required the victim to clone a hostile repository and ask Claude to review a specific file. Noma also credits Anthropic with iterating on every bypass until the fix was layered, which is the outcome you want from a vendor. And a Chromium-based preview pane is not unique to Claude: any agent app that renders model-touched HTML in an embedded browser has the same class of risk, which is exactly why the earlier GitLost agent leak and this one belong in the same mental file.

FAQ#

Which Claude Desktop version fixes SneakPeek?#

Noma's October 14 disclosure says Claude Desktop 1.30096.1 and later contain the fix, issued August 17, 2026, and delivered by auto-update. That version floor comes from the researchers; the GitHub advisory and CVE were still pending when this was written.

Does updating the Claude Code CLI fix it?#

Not by itself. The disclosed path is the Desktop app's preview renderer, so verify the Desktop app version separately and relaunch it after updating.

Was my machine compromised?#

You can only tell from evidence, not from the version number. Exposure needed an affected build, a hostile HTML file over 256KB in a repo you asked Claude to review, and the preview pane rendering it. If you cannot rule that out, review endpoint and network records for the period and rotate long-lived credentials.

Sources#

Continue Reading#

• How to Keep API Keys Away From Your AI Coding Agent: Claude Code vs Codex vs Cursor vs Gemini CLI - the three layers that keep secrets out of an agent's reach, including the credential masking that would have limited this exploit
• Claude Code Permissions: settings.json Allow, Deny, Ask - the agent-side controls, and why they do not cover a renderer
• GitLost: How Researchers Tricked GitHub's AI Agent Into Leaking Private Repos - another case where trusted-looking content drove data out
• AI Coding Agent Security Models Compared - how each tool treats credentials and boundaries
• Claude Code vs Codex vs Copilot CLI: Local Sandboxes Compared - containment options for code you did not write