A poisoned HTML file could escape the Claude Code Desktop preview pane and read credentials from your disk. Noma Labs named the flaw SneakPeek; Anthropic scored it CVSS 8.7 (High). It is fixed in Claude Desktop 1.30096.1 and later through auto-update, so check that your app has updated, and read on for what was exposed.
| Question | Short answer |
|---|---|
| Am I affected? | If you used the Claude Code Desktop preview on untrusted repositories before the August 17, 2026 fix. The affected range was not published |
| Is there a fix? | Yes: Claude Desktop 1.30096.1 and later, delivered by auto-update |
| Does it need a click? | No extra prompt, per Noma: asking Claude to look at the file was enough |
| Is there a CVE? | Pending at publication |
| Does data leave my machine? | In the attack, yes: the script sent it to an attacker's server |
How the SneakPeek attack works
The preview pane is an Electron (Chromium) panel that renders HTML files Claude creates or edits. Noma's write-up describes three gaps that chained together:
- A size threshold. Files under 256KB were loaded as base64
data:URLs with a Content Security Policy that blocks scripts. Larger files were written to disk and loaded asfile://URLs, which skipped that policy. - The wrong origin. A
file://load gave the renderer access to the local filesystem instead of an isolated opaque origin. - An inactive filter. A request filter meant to block
file://access did not engage when static HTML was rendered from disk.
The lure was a public repository holding what looked like a coverage report, padded past 256KB and carrying JavaScript. The developer clones it and asks Claude to review the report. The preview renders it, the script derives the home directory from the temp file path, and reads files such as SSH keys, AWS credentials, npm and GitHub tokens, Kubernetes config, Docker auth and Git credentials. It sends them out with navigator.sendBeacon().
Source: Noma Labs
The key point, as CSO's coverage puts it: the script ran in the rendering process, not as an action by the AI agent. Controls aimed at the model did not cover this path.
The patch bypass
Anthropic triaged the report on July 9, 2026 and shipped an initial mitigation that blocked fetch() and XMLHttpRequest to file://. On July 24 Noma showed a bypass: the same file reads, made from a Web Worker created from a blob: URL. Anthropic confirmed the fix was incomplete in early August (Noma's write-up says August 3, its press release says August 5) and deployed the final fix on August 17, per Noma's press release.
What this means if you run AI coding agents
- Update. Confirm Claude Desktop is at 1.30096.1 or later. Auto-update should have done it, but check the version in the app.
- Treat repository files as untrusted input. Until you are sure you are patched, avoid previewing HTML from repositories you did not write. A report or demo page is code.
- Shrink what a script can reach. Remove long-lived credentials from developer machines and prefer scoped, short-lived tokens, as Noma and Sysdig advise in CSO's article.
- Watch the runtime layer. Agent-level logs may not show this activity. File reads of
~/.sshor~/.awsand unexpected outbound connections from the desktop app are the signals to look for. - Consider rotating SSH keys and cloud keys if you previewed untrusted HTML before the fix. No source reports exploitation in the wild, so this is precaution, not confirmation.
What Beam can and cannot do here
Beam's deny works on agent tool calls through Claude Code and Codex PreToolUse hooks. SneakPeek ran inside the preview renderer, so no tool call happened for a hook to judge, and Beam would not have blocked it. Beam is also not a kernel sandbox. What it does cover is the neighbouring path: if a poisoned repository instead steered the agent into reading credentials or running commands, Beam's hooks can flag or deny those actions, and redaction removes secrets before storage. For the monitoring concept, see what AI agent monitoring is.
Why it matters beyond one pane
An agent's tooling includes its viewers, not just its model. The same lesson appears in agentjacking through an MCP server and Cursor MCP config poisoning: content you did not write can reach a trusted process. A fixed bug does not change the habit worth keeping, which is reviewing what you open from unknown sources.
Frequently asked questions
What is SneakPeek?
SneakPeek is a vulnerability in the Claude Code Desktop preview pane, disclosed by Noma Labs and scored CVSS 8.7 (High) by Anthropic. A malicious HTML file could run script with local file access when Claude previewed it.
Which version fixes SneakPeek?
Noma says the fix shipped in Claude Desktop 1.30096.1 and later through auto-update, with the final patch deployed on August 17, 2026. The affected version range was not published in the sources reviewed.
Did the attack need the user to approve anything?
According to Noma, no extra permission prompt appeared. The victim cloned a repository and asked Claude to look at a coverage report, and the preview rendered the file automatically.
Does it have a CVE?
Not at publication. CSO reports Anthropic is preparing a GitHub Security Advisory and has requested a CVE, and Noma lists the advisory as pending.
Was SneakPeek exploited in the wild?
None of the sources reviewed report exploitation in the wild. The research was reported to Anthropic on July 4, 2026 and fixed before public disclosure.
Would Beam have caught this?
Probably not. The script ran inside the preview renderer, not as a tool call by the agent, so hook-based checks on agent actions do not see it. Updating the app and limiting stored credentials are the effective defenses.
Related reading
- Stop Claude Code from running dangerous commands
- Agentjacking through an MCP server
- What is AI agent monitoring?
- Claude Code plugin hash pin bypass (CVE-2026-86063)
- Noma Labs write-up
Details are accurate as of October 14, 2026. A CVE and advisory were still pending; check Anthropic's advisory for later changes.