Anthropic 'SneakPeek' Flaw Is a Silent Zero-Click Threat
Anthropic Claude Code Desktop flaw allows silent zero-click credential theft.
Run Anthropic?
Get an email when a reviewed story names Anthropic, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
A critical vulnerability, dubbed 'SneakPeek,' has been discovered in Anthropic's Claude Code Desktop application. This zero-click flaw allows attackers to silently steal sensitive developer credentials, including SSH private keys, AWS credentials, and Claude OAuth tokens, by exploiting the application's preview pane functionality. The exploit requires no user interaction, making it a significant threat to developers using the tool.
The lesson from this incident
Full lessonThe 'SneakPeek' vulnerability in Anthropic's Claude Code Desktop exploits the application's preview pane to silently steal highly sensitive credentials — including SSH private keys, AWS tokens, and OAuth secrets — without requiring any user interaction. This zero-click attack vector is particularly dangerous because traditional security awareness training offers no defense; developers cannot 'avoid' a threat they never see or trigger. The exposure of SSH and cloud credentials can cascade into full infrastructure compromise, lateral movement, and persistent unauthorized access. This incident highlights the risk of storing long-lived, high-privilege credentials in environments adjacent to third-party tooling. Developers and security teams must treat AI-assisted developer tools with the same scrutiny applied to any privileged software in the software supply chain.
What helps against this
How we list vendors- Secrets management
API keys, tokens and passwords stop leaking from code, chat and configuration files.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Security awareness training and phishing simulation
People recognise and report attacks instead of falling for them.