> How Claude Code’s 256KB blind spot put developers’ secrets in the preview pane

Simply asking Anthropic’s Claude Code to review an HTML file could hand attackers access to a developer’s machine, cloud credentials and software development environment, according to a new Noma Security finding. Noma’s researchers found a vulnerability affecting Anthropic’s Claude Code Desktop app that could allow malicious JavaScript embedded in an HTML file to execute without further user interaction, potentially exposing sensitive host files. The flaw, called SneakPeek, specifically affected the application’s automated preview pane, which renders HTML files generated or modified by Claude. “This is a strong example of how emerging technologies are reshaping the attack surface,” said Ronald Lewis, head of cybersecurity governance at Black Duck. “Attackers are increasingly targeting the AI ecosystem, exploiting implicit trust relationships between models, agents, tools, data sources, and connected services.” An attacker could exploit the bug by planting a malicious file in a public repository and waiting for a developer to ask Claude Code to inspect it, Noma said in a blog post shared with CSO ahead of its publication on Wednesday. Once the application rendered the file, the script could read local files and exfiltrate sensitive data, including AWS credentials, GitHub secrets and SSH private keys, to a remote server. The flaw has been assigned a high-severity CVSS score of 8.7, while a CVE ID is not yet available. Noma says Anthropic collaborated with Noma Labs during the disclosure process and fully resolved the issue. “Anthropic confirmed they are preparing a GitHub Security Advisory and have requested a CVE for it,” Eli Ainhorn, senior AI vulnerability researcher at Noma, told CSO. “We expect it to be available soon. The CVSS score is 8.7 High (v4.0), assigned by Anthropic. Anthropic did not immediately respond to CSO’s request for comment. A 256KB threshold allowed local files to leak Noma traced SneakPeek to three architectural gaps in Claude Code Desktop’s preview mechanism, which uses an Electron-based Chromium rendering panel to display HTML content. The first involved a file-size threshold that changed how the application handled HTML documents. Files smaller than 256KB were converted into base64-encoded data: URLs with a strict Content Security Policy (CSP) that blocked script execution. Files exceeding that threshold were instead written to disk and loaded directly as “file://” URLs, bypassing the CSP protections applied to smaller files. The second problem was the origin assigned to the rendered content. Loading the larger files through file:// gave the preview renderer access to the local filesystem in Chromium rather than confining it to an isolated, opaque origin, the researchers said. The third weakness was an inactive request filter. Although the application has a mechanism intended to block file: // access, Noma found that the filter was not active during static file rendering, including when developers reviewed local code test reports. “Relying on size-based thresholds or client-side filters for security boundaries is inherently fragile,” Lewis said. “Development machines hold high-value operational secrets—SSH private keys, AWS credentials, Kubernetes configurations, and OAuth session tokens.” Compromising a developer’s local workstation is effectively a direct route into corporate cloud infrastructure, he warned. Noma found that Anthropic’s initial patch could be bypassed. “The initial patch blocked the preview pane from making direct file read requests from the main page context, but we found that by moving the file-reading code into a Web Worker, a background thread that browsers run separately from the main page, the requests originated from a context the patch didn’t cover,” Ainhorn explained. The researchers reported the bypass, prompting a deeper architectural fix before the vulnerability was fully resolved. Risk beyond the AI model The malicious script ran inside the preview pane’s rendering process, rather than as an action performed by the AI agent itself. That defeats the assumption that security controls meant for the model are protecting all AI workflows. “The protections were real, they just didn’t cover every path,” Ainhorn said. “Organizations need to keep AI coding tools updated, stop leaving long-lived credentials on developer machines, and use scoped, short-lived tokens where possible. That alone would have limited what this exploit could grab.” According to Sysdig’s senior cybersecurity strategist Crystal Morin, agent-level logs would not necessarily capture the execution. File reads and outbound network connections would instead be visible at the runtime layer, where defenders need appropriate monitoring, Morin said. “The endpoint is where AI agents start, but their blast radius extends to the cloud,“ she added, warning that routine work with AI tools can expose credentials with consequences far beyond the workstation.