A critical, silent zero-click flaw in Anthropic’s Claude Code Desktop preview pane could quietly exfiltrate credentials from developers’ machines. The vulnerability arose from three architectural gaps in the preview pane that rendered HTML documents automatically as developers edited or reviewed them, bypassing sandbox protections that were assumed to be in place.
Researchers from Noma identified missing content security policy, unrestricted origin access, and inactive request filtering as the gaps that, when chained, allowed an attacker to trigger background data exfiltration without any prompt or interaction from the user.
In practice, a threat actor could host a malicious, code-repo’d HTML file padded with large content and embedded scripts; when Claude Code attempted to render the file, the hidden script could steal AWS and GitHub credentials, API keys, Claude’s OAuth tokens, and other sensitive data on the host.
Anthropic confirmed the issue and collaborated with Noma on disclosure and remediation. The initial fix, dubbed SneakPeek, was bypassed, prompting deeper architectural changes and a reworked patching process. The vulnerability was first reported on 4 July, with a fix deployed on 9 July, a bypass found by Noma on 24 July, and a final patch released on 17 August ahead of the advisory. Experts emphasise the need for aggressive automated patching and for developers to keep long‑lived credentials off their machines.
As Eli Ainhorn from Noma notes, robust security solutions with both visibility and runtime protection are essential for organisations employing autonomous agents in production.