Noma Labs disclosed on October 14 a high-severity flaw it calls SneakPeek in Claude Code Desktop's HTML preview pane. HTML files larger than 256KB took a different rendering path that loaded them from disk with local filesystem access, no content security policy and an inactive request filter — so a script hidden in a file, for example a padded code-coverage report in a public repository, could run when a developer simply asked Claude to review it.

In Noma's tests the script could silently send SSH private keys, AWS credentials, GitHub and npm tokens, Kubernetes configs and Claude's own OAuth tokens to an attacker's server, with no click or permission prompt. Anthropic rated the flaw CVSS 8.7 and treated its impact as equivalent to code execution on the host. No exploitation in the wild has been reported.

The disclosure was coordinated: Noma reported the issue on July 4, Anthropic's first fix on July 9 was bypassed on July 24 via a Web Worker route, and the final fix shipped August 17 in Claude Desktop 1.30096.1. Developers should confirm the Desktop app — not just the command-line tool — is on 1.30096.1 or later, and treat repository HTML as untrusted.