New Findings Uncover Vulnerability in Claude Code, Threatening Developer Security
Research from Noma Security has revealed a significant vulnerability in Anthropic's Claude Code Desktop application, exposing developers to potential data theft. By merely asking Claude Code to review an HTML file, malicious actors could gain access to sensitive information from a developer's machine, including cloud credentials and software development environments.
The vulnerability, termed SneakPeek, was identified in the app's automated preview feature, which is responsible for rendering HTML files. This flaw permits JavaScript, embedded in the HTML, to execute autonomously, making sensitive host files vulnerable to unauthorized access.
Ronald Lewis, head of cybersecurity governance at Black Duck, remarked, “This demonstrates how emerging technologies can reshape the attack surface.” The research indicates that as attack methods evolve, criminals are increasingly exploiting the inherent trust between different components of the AI ecosystem.
An attacker could exploit this vulnerability by embedding a malicious file in a public repository, waiting for an unsuspecting developer to utilize Claude Code to inspect it. Once the application rendered the file, the deployed script could extract sensitive local files, including AWS credentials, GitHub secrets, and SSH private keys, subsequently sending them to a remote server.
The flaw has been assigned a CVSS score of 8.7, indicating high severity, although a CVE ID has yet to be allocated. Noma confirmed Anthropic's cooperation during the disclosure process, resulting in a resolution of the issue.
According to Eli Ainhorn, a senior AI vulnerability researcher at Noma, Anthropic plans to issue a GitHub Security Advisory and has sought a CVE for this vulnerability. "They confirmed that the CVSS score of 8.7 has been assigned by Anthropic," Ainhorn noted.
A Threshold and its Consequences
The vulnerability traces back to three architectural weaknesses within Claude Code's preview mechanism, which relies on an Electron-based Chromium rendering panel for displaying HTML content.
The first issue involves a file-size threshold that altered how HTML documents were handled. Content smaller than 256KB was converted to base64-encoded data URLs, thereby enforcing a strict Content Security Policy (CSP) that hindered script execution. In contrast, larger files were written directly to disk and accessed as "file://" URLs, bypassing the CSP protections intended for smaller files.
The second issue pertains to the origin of the rendered content. Accessing larger files through "file://" enabled the preview renderer to access the local filesystem in Chromium, rather than confining operations to an isolated origin.
The third concern identified was an inactive request filter. Although the app includes a mechanism aimed at blocking "file://" access, Noma's research indicated that the filter was inactive during the rendering of static files, such as when developers review local code test reports.
Lewis highlighted the risks of depending on size-based thresholds or client-side filters for security, stating, “Development machines often harbor high-value operational secrets such as SSH private keys and AWS credentials.” He cautioned that compromising a developer's workstation could provide attackers direct access to corporate cloud infrastructures.
Interestingly, Noma noted that the initial patch implemented by Anthropic could be circumvented. While it effectively blocked direct file read requests, researchers discovered that moving this code to a Web Worker—a background thread within browsers—permitted requests to originate from a context unfiltered by the patch.
This led to the discovery being reported back to Anthropic, prompting a more comprehensive architectural fix to ensure the vulnerability was effectively addressed.
Beyond the AI Model
The malicious script ran within the rendering process of the preview pane, rather than as an action executed by the AI model itself. This raises a critical security concern: the protective measures designed for the AI model do not encompass every operational path within AI workflows.
Ainhorn commented, “The protections were effective; they just didn’t address every possible issue.” He urged organizations to keep AI coding tools current, avoid storing long-lasting credentials on developer machines, and to employ scoped, short-lived tokens to limit potential exploitation. Such practices could have notably reduced information accessibility to this exploit.
Sysdig’s cybersecurity strategist, Crystal Morin, pointed out that standard agent-level logs might not capture these specific executions, with file reads and outbound network connections only visible at the runtime layer. “Defenders must ensure appropriate monitoring at this level, as AI agents begin at the endpoint but can extend their impact into the cloud,” Morin stated, highlighting how regular interactions with AI tools can lead to security breaches that have implications beyond the immediate workstation.
