A flaw in the preview pane of Anthropic’s Claude Code Desktop app could have let a malicious web file read developers’ cloud credentials and private keys and send them to an attacker, researchers at security company Noma Security said, CSO Online reported Wednesday. Anthropic has fixed the issue, according to the researchers. The case shows that the risk in AI coding tools extends beyond what the model does to the ordinary app features around it, on machines that often hold keys to company cloud systems.

What Happened

Claude Code Desktop shows a live preview of HTML files, the code behind web pages, that Claude creates or edits. According to Noma’s findings as described by CSO Online, the app handled those files in two ways depending on size. Files under 256 kilobytes were loaded under a strict security policy that blocks scripts from running. Larger files were saved to disk and opened directly from the local file system, which skipped that policy and gave the page access to files on the computer.

A filter meant to block that file-system access was also not active when the preview displayed static files, Noma said. The result: JavaScript hidden in a large HTML file could run as soon as the preview rendered it, with no further click, read secrets such as Amazon Web Services credentials, GitHub secrets and SSH private keys, and send them to a remote server.

RelatedNew curl Release Fixes 24 Flaws, Including a High-Severity Bug Reported With Anthropic’s Claude

Noma, which named the flaw SneakPeek, described a simple route for an attacker: plant such a file in a public code repository and wait for a developer to ask Claude Code to review it.

Anthropic’s first patch stopped the preview page itself from reading local files, CSO Online reported. Noma got around it by moving the file-reading code into a Web Worker, a background process the patch did not cover. After the bypass was reported, Anthropic made a deeper change to how previews work, which Noma says fully resolves the issue.

Anthropic assigned the flaw a severity score of 8.7 out of 10, rated high, under version 4.0 of the Common Vulnerability Scoring System, the industry’s standard scale. Eli Ainhorn, a Noma researcher, told CSO Online that Anthropic is preparing a GitHub security advisory and has requested a CVE, a public identifier for the flaw. The report did not give dates for the disclosure or the final fix, or list the affected app versions. Anthropic did not immediately respond to CSO Online’s request for comment.

Why It Matters

The malicious code ran in the app’s display layer, not as an action by the AI agent. That means controls aimed at the model and its actions did not apply, and agent activity logs may not record anything. Crystal Morin of the security company Sysdig told CSO Online that the file reads and outbound connections would be visible only at the runtime layer, meaning monitoring of what processes on the machine actually do.

For executives, the practical exposure sits on developer laptops. Long-lived cloud and code-hosting credentials stored there can open a path into production infrastructure. Ainhorn said scoped, short-lived tokens alone would have limited what the exploit could take. Organizations rolling out AI coding assistants should treat those machines as high-value targets, keep the tools updated and monitor them at the operating-system level, not only through the AI tool’s own logs.

What to Watch

The GitHub advisory and CVE from Anthropic should state which versions were affected and when the fix shipped, letting security teams check whether their developers ran vulnerable builds. Also watch whether researchers keep finding flaws in the features that surround AI agents, such as previews, extensions and integrations, where conventional software bugs can sidestep protections designed for the model.