Security Flaw in Anthropic's Claude Code Exposes Developer Secrets Through HTML Previews

Recent findings from Noma Security have unveiled a significant security flaw in Anthropic's Claude Code Desktop application. This vulnerability allows attackers to gain unauthorized access to sensitive developer information—such as cloud credentials and system configurations—simply by having Claude Code inspect an HTML file.

The vulnerability, identified as SneakPeek, revolves around the automated preview pane of the Claude Code app that renders HTML files created or modified within the environment. This flaw permits malicious JavaScript embedded in such files to execute without further user consent, potentially leading to data breaches.

“This exemplifies how new technologies are shifting the threat landscape,” said Ronald Lewis, head of cybersecurity governance at Black Duck. “Attackers are increasingly exploiting vulnerabilities in the AI ecosystem, taking advantage of the inherent trust between models and associated tools.”

According to Noma's detailed blog post, an attacker might upload a compromised file to a public repository, waiting for a developer to request an inspection through Claude Code. Once the application processes the file, the embedded script could access crucial local files, exfiltrating sensitive data—ranging from AWS credentials to SSH private keys.

This security issue has been rated with a high severity CVSS score of 8.7. While no CVE ID has been assigned yet, Noma reported that Anthropic has been proactive in addressing the flaw, collaborating with Noma Labs throughout the disclosure process.

“Anthropic has confirmed they’re drafting a GitHub Security Advisory and have sought a CVE ID,” noted Eli Ainhorn, Noma's senior AI vulnerability researcher. “The score from Anthropic validates the urgency, reflecting the high impact of the vulnerability.”

A 256KB Limit Exposes Local Files

Noma's investigation highlighted three critical architectural oversights in Claude Code's HTML rendering process. The app utilizes an Electron-based Chromium rendering environment, creating a significant security gap regarding how HTML documents are treated based on size.

Files smaller than 256KB are encoded into base64 data, which applies a strict Content Security Policy (CSP) that blocks script execution. However, files larger than this threshold are read directly from disk as “file://” URLs, which bypass the CSP protections, enabling potential access to the local file system.

Another issue arose from the origin context assigned to these larger files. By loading them via “file://”, the preview renderer could interact with the local file system rather than maintaining a restricted and opaque environment, as intended.

Additionally, there was an inactive request filter meant to block “file://” access when reviewing static files. Noma's examination revealed that this filter did not function during the rendering phase, leaving developers' local environments vulnerable.

“Security measures shouldn’t rely solely on file size and client-side filters,” Lewis cautioned. “Development machines house critical operational secrets, and compromising them provides direct pathways into corporate cloud infrastructure.”

Noma's assessments revealed that the initial patch released by Anthropic could be circumvented. “The patch barred the preview pane from making direct requests, but we demonstrated that by relocating the file-reading process into a Web Worker, those requests originated from an unprotected context,” Ainhorn remarked.

This prompted a more comprehensive architectural revision to address the vulnerability fully.

Broader Implications Beyond AI Models

The malicious code executes within the rendering process of the preview pane, distinctly separating it from actions taken by Claude Code itself. This undermines the assumption that the security measures applied to the AI model would safeguard all workflows using it.

“The protections are in place, but they don’t encompass every possible vector,” Ainhorn explained. “Organizations should ensure their AI coding tools are current, avoid keeping long-term credentials on developer machines, and opt for scoped, temporary tokens to mitigate potential data exposure.”

According to Crystal Morin, a cybersecurity strategist at Sysdig, typical agent-level logs might not capture the exploit's execution. Monitoring file reads and outbound network activity is essential to maintain security at the runtime layer. “AI agents begin at the endpoint, yet their implications can extend deeply into the cloud,” she mentioned, emphasizing that frequent interactions with AI tools increase the risk of credentials being exploited with far-reaching consequences.