What happened
Noma Labs disclosed 'SneakPeek' (published 2026-10-19), an exploit chain in Claude Code Desktop's preview pane that achieves arbitrary file read via unrestricted JavaScript execution. The attacker plants an HTML file padded past 256KB with an embedded script in a public repo; when the victim asks Claude to review it, the preview renders the file and silently exfiltrates credentials to an attacker server. Anthropic scored it CVSS 8.7 (High) and treated the impact as equivalent to code execution on the host.
Why it matters
This is a real-world, low-friction compromise of an AI coding agent's host. The rendering step is the attack surface — the agent itself reads the untrusted file on the victim's behalf, so no approval prompt or click is needed before attacker JavaScript runs with host-filesystem access, exposing every credential on a developer machine.
Attack vector
Three chained gaps bypass the preview sandbox: (1) files over 256KB are loaded as file:// URLs instead of CSP-scoped data: URLs, so JavaScript runs unrestricted; (2) file:// origin grants the renderer local filesystem access; (3) the request filter meant to block file:// reads does not engage for static HTML rendered directly from disk. A script exfiltrates host files via fetch()/sendBeacon().
Affected systems
Anthropic Claude Code Desktop (preview pane / artifact renderer, Electron)
Mitigation
Anthropic issued a layered fix (Aug 2026) and an advisory/CVE in October 2026. Update Claude Code Desktop; the patch had to iterate through a blob: URL Web Worker bypass before final remediation.