How Claude Code’s 256KB blind spot put developers’ secrets in the preview pane
Summary
Researchers at Noma Security have discovered a vulnerability in Anthropic's Claude Code Desktop app called SneakPeek. This flaw allows malicious JavaScript embedded in HTML files to execute automatically, potentially exposing sensitive developer information such as cloud credentials and secrets to attackers.
IFF Assessment
This vulnerability allows attackers to gain access to sensitive developer information, representing a significant risk to defenders.
Severity
The CVSS score of 8.7 indicates a high severity, likely due to an easy attack vector (malicious HTML file) and significant impact (exposure of credentials and secrets).
Defender Context
This incident highlights the growing attack surface presented by AI-powered development tools. Defenders should be vigilant about the security of AI applications and the potential for embedded malicious code, especially when dealing with code review or preview functionalities.