2026-10-14 · 2026-Q4
"SneakPeek": Claude Code Desktop's Preview Pane Let a Large HTML File Read and Exfiltrate Local Secrets
Who wrote the file that runs on open?
- Fixable
- Vendor patch
- Vendor response
- Patched
- In the wild
- No
- Actor
- Attacker
Target
Claude Code in Claude Desktop before 1.30096.1
Impact
Noma Labs found that HTML files over 256 KB were loaded from disk as `file://` URLs outside the Content Security Policy applied to smaller files, and the local-file request filter only engaged when proxying a dev server. A padded coverage report planted in a repository could, when a developer asked Claude to review it, read SSH keys, AWS credentials, npm and GitHub tokens, Kubernetes and Docker credentials, and Claude's own OAuth tokens, and send them out. Anthropic's first patch was bypassed by moving the reads into a Web Worker created from a `blob:` URL. Anthropic scored it CVSS v4 8.7. Reported July 4, fixed August 17, published October 14, 2026; CVE pending
Root cause
A security boundary keyed to file size and dev-server mode instead of applying to all rendered content
Sources
Catalog
Cite this: AgentProv incident record: "SneakPeek": Claude Code Desktop's Preview Pane Let a Large HTML File Read and Exfiltrate Local Secrets (2026-10-14). https://agentprov.com/incidents/2026-10-14-sneakpeek-claude-code-desktop-s-preview-pane-let-a-large-html-file-read-and
Related
- Also L5 · 2026-10-25Planted AGENTS.md in a Downloads Folder Got Codex to Install Malware; a CLAUDE.md Variant Exposed Claude Code's OAuth TokenL5Config
- Also L5 · 2026-10-21MCP Inspector Advisory Batch: Two Critical Paths From Connecting to a Malicious MCP Server to Local Command ExecutionL5Config
- Also L5 · 2026-10-16Claude Agent SDK: A Crafted Session ID Injects an MCP Server and Runs Commands Past SDK Permissions (CVE-2026-96620)L5Config