Noma Labs disclosed three flaws in Claude Code Desktop’s preview pane. Files over 256KB load as file:// URLs instead of sandboxed URLs. CSP only protected the data URL path. An inactive filter let fetch() read local files. Embed malicious JavaScript in a public repository; when a developer asks Claude to review it, the preview pane auto-executes and exfiltrates SSH keys, AWS tokens, and Git secrets.
Patched August 17, 2026 (v1.30096.1+). The first patch was bypassable via Web Workers; Anthropic deployed a multi-layered fix.
The 256KB threshold wasn’t a security boundary; it was a performance constraint that became a security assumption. When three systems aligned, the gap became exploitable. No single component failed; the attack existed only at their intersection. Security review misses these blind spots.
Sources: SneakPeek: How the Preview Pane in Claude Code Desktop Can Exfiltrate Your Data • Noma Labs Uncovers Critical Security Vulnerabilities in Claude Code Desktop App
Coverage: Anthropic ‘SneakPeek’ Flaw Is a Silent Zero-Click Threat • How Claude Code’s 256KB blind spot put developers’ secrets in the preview pane
Related on this blog: OpenAI’s Six Misalignment Reports Read Like a Controls Audit • [AUTO] Any User Can Become Admin in LiteLLM • [AUTO] MemTensor Worm Exploits GitHub Actions Token Interception