Research · Oct 14, 2026
Vulnerability in Anthropic's Claude Code Exposes Developer Secrets
A significant vulnerability has been discovered in Anthropic's Claude Code Desktop application, potentially compromising developers' sensitive information. Researchers from Noma Security identified a flaw, dubbed 'SneakPeek', which affects the app's automated preview pane that renders HTML files.
What changed
This vulnerability allows malicious JavaScript embedded within an HTML file to execute without any user interaction, posing a serious risk of exposing sensitive files on a developer's machine. The implications of this flaw are particularly troubling, as it could lead to the unauthorized access and exfiltration of critical data, such as AWS credentials, GitHub secrets, and SSH private keys.
Who is affected
Attackers could exploit this weakness by placing a malicious file in a public repository and enticing developers to request an inspection via Claude Code. Once the application processes the file, the embedded script could gain access to local files and send sensitive information to a remote server.
What it means
This incident underscores the evolving threat landscape, particularly as attackers increasingly target AI ecosystems and exploit the inherent trust between various components and services. 7, highlighting the urgent need for developers to be cautious when interacting with AI tools that process external files.