Claude Code Desktop Flaw Let Malicious HTML Steal Developer Credentials
Claude Code Desktop flaw allowed malicious HTML to steal developer credentials and private keys.
Run Anthropic?
Get an email when a reviewed story names Anthropic, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
A high-severity vulnerability, dubbed SneakPeek, was discovered in Anthropic's Claude Code Desktop application by Noma Labs. The flaw, with a CVSS score of 8.7, allowed malicious HTML files to steal local credentials and private keys, including SSH keys, AWS credentials, and GitHub tokens, by exploiting weaknesses in the preview pane's rendering engine. Anthropic has since released patches to address the vulnerability.
The lesson from this incident
Full lessonThe SneakPeek vulnerability in Anthropic's Claude Code Desktop exposed a critical weakness in how the application's preview pane rendered HTML content, allowing malicious files to access and exfiltrate sensitive local credentials such as SSH keys, AWS credentials, and GitHub tokens. This type of flaw — where a rendering engine fails to sandbox untrusted content — is particularly dangerous in developer tooling because developers routinely handle high-privilege credentials and secrets in their local environments. The high CVSS score of 8.7 reflects how easily an attacker could exploit this by tricking a developer into previewing a crafted HTML file. This matters because a single compromised developer machine can cascade into full cloud environment takeovers or source code repository breaches. Anthropic's patch mitigates the immediate risk, but the incident highlights the systemic danger of insufficient isolation in tools that process untrusted input.
What helps against this
How we list vendors- Secrets management
API keys, tokens and passwords stop leaking from code, chat and configuration files.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Security awareness training and phishing simulation
People recognise and report attacks instead of falling for them.