SneakPeek: a big HTML file let Claude Code Desktop's preview read local keys

01What happened

Noma Labs published SneakPeek on October 14, 2026, a flaw its researcher Eli Ainhorn found in the HTML preview pane of Claude Code Desktop. Ainhorn reported it to Anthropic on July 4, 2026, then bypassed Anthropic's first patch on July 24. Anthropic shipped the working fix on August 17 in Claude Desktop 1.30096.1.

02How it works

Claude Code Desktop renders preview HTML in Electron's Chromium engine. Files under 256KB load as data: URLs, where a content security policy applies; larger files are written to a temp file and loaded over file://, where it does not, so embedded JavaScript runs unrestricted. A request filter blocked file:// reads from the main page, so Ainhorn moved the read into a Web Worker created from a blob: URL, which the filter did not cover. The payload sent what it collected to the attacker's server with navigator.sendBeacon.

03Who is affected

Developers running Claude Desktop before version 1.30096.1 were exposed. Exploitation needed the developer to clone a repository holding the padded HTML file, disguised as a test coverage report, and ask Claude to review it; the preview then rendered it with no permission prompt.

04What to do

Update Claude Desktop to 1.30096.1 or later, which Anthropic delivered by auto-update on August 17, 2026. Anyone who previewed HTML from an untrusted repository on an older build should rotate the credentials listed below, because Noma's payload read them from the developer's own machine.

Questions people ask

Which Claude Desktop version fixes the SneakPeek preview pane flaw?

Claude Desktop 1.30096.1 and later fix the SneakPeek flaw, according to Noma Labs, and Anthropic shipped that build on August 17, 2026 through the app's auto-update. Noma reported the original issue on July 4 and bypassed Anthropic's first patch on July 24, so builds carrying only that earlier fix stayed exploitable until August.

Does SneakPeek have a CVE number?

SneakPeek has no published CVE as of Noma's October 14, 2026 write-up. Noma's Eli Ainhorn told CSO Online that Anthropic confirmed it is preparing a GitHub Security Advisory and has requested a CVE identifier. Anthropic scored the flaw 8.7 on CVSS version 4.0 during triage, a rating Noma reports from that exchange rather than from a public advisory.

Should I rotate credentials after the SneakPeek disclosure?

Rotation is worth considering for developers who previewed HTML from untrusted repositories in Claude Desktop before August 17, 2026. Noma's demonstrated payload read SSH private keys, AWS access keys, npm and GitHub tokens, Kubernetes and Docker credentials, and Claude's own OAuth tokens, then sent them to a server the attacker controlled. Nothing in the preview warned the developer.

Sources 2 links, all fetched

1. 1noma.securityNoma Labs Write-Up
2. 2csoonline.comCSO Online Report