Claude Code's HTML preview pane silently exfiltrated AWS credentials, SSH keys, and GitHub secrets
Published · updated · curated by AI Is Going Just Great
Source: csoonline.com ↗
"The endpoint is where AI agents start, but their blast radius extends to the cloud."
A vulnerability in Anthropic's Claude Code Desktop app, dubbed SneakPeek by researchers at Noma Security, let malicious JavaScript embedded in an HTML file execute automatically when a developer asked Claude to review it. No further interaction required. The script ran inside the app's preview pane and could read local files and ship them to a remote server, including AWS credentials, SSH private keys, and GitHub secrets. Anthropic assigned the flaw a CVSS score of 8.7 (High).
The root cause was a 256KB file-size threshold: files under that limit were sandboxed with a strict Content Security Policy, while larger files were loaded as file:// URLs with full local filesystem access in Chromium. A request filter meant to block that access wasn't active during static file rendering. Noma also found that Anthropic's first patch could be bypassed by moving the file-reading code into a Web Worker, a background thread the patch didn't cover. A second, deeper architectural fix closed it. The issue is now fully resolved.