Skip to content
Today
Sections

Build Independently confirmed2 publishers 2 min read Published

Claude Code Desktop's preview pane ran scripts in HTML files over 256KB

Noma Security reported that Claude Code Desktop's preview ran scripts in HTML files over 256KB, a flaw Anthropic fixed in 1.30096.1. Those scripts could read SSH keys, AWS credentials and GitHub tokens, so previewed repo files should be handled as untrusted code.

The Engineer · Build desk

Send a correction

A patch went back for retest before the fix shipped Disclosure steps per Noma's timeline, from its report to Anthropic to publishing the SneakPeek research.

Timeline: July 4, Noma reports the chain to Anthropic with a proof of concept. July 24, Anthropic's patch blocking fetch() to file:// goes back for retest. August 17, the fix ships in Claude Desktop 1.30096.1. October 14, 2026, Noma publishes SneakPeek.

  1. 2026Noma reports the chain to Anthropic with a proof of concept, claim 11
  2. 2026Anthropic's patch blocking file:// fetch() goes back for retest, claim 12
  3. 2026Fix ships via auto-update in Claude Desktop 1.30096.1, claim 3
  4. 2026Noma Security publishes the research, called SneakPeek, claim 1
A patch went back for retest before the fix shipped
DateEventClaim
July 4, 2026Noma reports the chain to Anthropic with a proof of concept11
July 24, 2026Anthropic's patch blocking file:// fetch() goes back for retest12
August 17, 2026Fix ships via auto-update in Claude Desktop 1.30096.13
October 14, 2026Noma Security publishes the research, called SneakPeek1

What happened

  • Files under 256KB loaded as data: URLs with a script-src 'none' policy and an opaque origin, so embedded scripts were blocked, according to Noma.
  • Larger files were written to a temp file and loaded over file://, a path that never got the policy, and in Chromium that origin can use fetch() to read other local files.
  • A request filter that blocked file:// reads was active only while the pane proxied a dev server, so it did nothing for a static HTML file rendered from disk.
  • Noma's proof of concept needs a cloned repo with a padded coverage report and a request to review it, and Noma says no permission prompt appears.
  • Anthropic scored the flaw CVSS v4.0 8.7 (High).

Why it matters

  • Who's exposed exposure The path from a stranger's repo to a developer's credentials is demonstrated in a proof of concept, but neither Noma's post nor its press release reports exploitation in the wild.
  • Who has to decide decision The bug sits in the Claude Desktop app's preview renderer, so that app's version is the one teams have to check, and any machine where auto-update is paused or blocked is the one most likely to be behind.
  • What doesn't add up contradiction Noma's post lists the advisory and CVE as pending while its press release says they were posted in October, so patch tracking has no identifier yet.

Anthropic's first fix, on July 24, blocked fetch() and XMLHttpRequest to file:// from the page and went back for a retest [12]. The same day, Noma moved the fetch() into a Web Worker created from a blob: URL, a context the filter did not cover [13]. In our view that fix was a denylist on two named APIs, and a Worker sat outside it.

Anthropic confirmed the bypass in early August and started a deeper fix [14]. It shipped on August 17 [3], 44 days after Noma's July 4 report [22][11] and 24 days after the bypass [23]. The sources do not describe what the deeper fix changed.

The original bug is the more portable lesson. The researcher who wrote it up told CSO Online: "The protections were real, they just didn't cover every path." [7] The 256KB cutoff is specific to this app. What transfers is any branch where a property of the input, such as size, type or origin, selects a loader. Each branch needs the same policy, and the cheap test is to push one hostile file down every path.

Per Noma, Anthropic "treated the impact as equivalent to code execution on the host." [17] Noma's post says the company "took Noma's disclosure seriously from the start." [20]

Anthropic's docs say the Browser pane can "open static HTML files, PDFs, images, and videos from your project" next to the dev servers Claude starts to check its own changes [16]. So the input is the repo itself. We'd handle a previewed file from a repo you did not write the way you would handle a script from it.

On versions, the dev.to write-up notes that the bug and the fix are in the Desktop app's preview renderer, so Claude Desktop's version is the one that counts [18]. The target is 1.30096.1 or later [3].

According to CSO Online, Anthropic is working on a GitHub Security Advisory and has asked for a CVE [24]. Noma's post shows the advisory and the CVE as still pending, while its press release says they were posted in October [24]. As of October 14, none of the sources gives a CVE ID [25]. Anthropic did not immediately respond to CSO Online's request for comment [21].

What to watch

  • Publication of the GitHub Security Advisory and a CVE ID.
  • Anthropic's account of what the deeper fix changed beyond blocking fetch() and XMLHttpRequest to file://.
  • Any report of exploitation before the August 17 fix.

Clarity's read

What the record supports and how the coverage leans. The claims behind it follow.

Reality

Evidence58
Adoption
Not scored
Hype gap+15
Incentives40
Confidence68
Why these scores

Claim ledger

Ranked by verification strength, evidence, and original report placement.

  1. [1]

    Noma Security published the research, which it calls SneakPeek, on October 14, 2026.

    Reported Supported Source: dev.to write-up of Noma Security researchView cited source
  2. [2]

    The bug was in the HTML preview of the Claude Code Desktop app, not in a model.

    Reported Supported Source: dev.to write-up of Noma Security researchView cited source
  3. [3]

    The fix shipped on August 17 and reached users through auto-update in Claude Desktop 1.30096.1, per Noma's timeline.

    Reported Supported Source: Noma's timeline, as reported by dev.toView cited source
  4. [4]

    Files under 256KB loaded as data: URLs with a Content Security Policy of script-src 'none' and an opaque origin, so embedded scripts were blocked.

    Reported Supported Source: Noma, as reported by dev.toView cited source
  5. [5]

    Files over 256KB were written to a temp file and loaded as file:// URLs. That path never got the CSP, and in Chromium a page on a file:// origin could use fetch() to read other local files.

    Reported Supported Source: Noma, as reported by dev.toView cited source
  6. [6]

    A request filter did block file:// reads, but only when the pane was proxying a dev server. It was not active when the pane rendered a static HTML file from disk.

    Reported Supported Source: Noma and CSO Online, as reported by dev.toView cited source
  7. [7]

    The researcher who wrote it up told CSO Online: "The protections were real, they just didn't cover every path."

    Reported Supported Source: Noma researcher, quoted by CSO Online via dev.toView cited source
  8. [8]

    In Noma's proof of concept, an attacker publishes a repository with a coverage report padded past 256KB with a script inside; the victim clones it and asks Claude to review a file; the preview pane renders it, the script runs, and Noma says no permission prompt appears.

    Reported Supported Source: Noma, as reported by dev.toView cited source
  9. [9]

    The script reads files such as SSH keys, AWS keys, npm and GitHub tokens, Kubernetes credentials, Docker registry auth and Claude's own OAuth tokens, and sends them out with navigator.sendBeacon().

    Reported Supported Source: Noma, as reported by dev.toView cited source
  10. [10]

    Noma's TL;DR adds that the payload could also get the user's real IP address through WebRTC.

    Reported Supported Source: Noma, as reported by dev.toView cited source
  11. [11]

    On July 4, Noma reported the chain to Anthropic with a proof of concept.

    Reported Supported Source: Noma's post and press release, as reported by dev.toView cited source
  12. [12]

    On July 24, Anthropic's patch, which blocked fetch() and XMLHttpRequest to file:// from the page, went back for a retest.

    Reported Supported Source: Noma's post and press release, as reported by dev.toView cited source
  13. [13]

    The same day, Noma moved the fetch() into a Web Worker created from a blob: URL, a context the filter did not cover.

    Reported Supported Source: Noma's post and press release, as reported by dev.toView cited source
  14. [14]

    In early August, Anthropic confirmed the bypass and started a deeper fix.

    Reported Supported Source: Noma's post and press release, as reported by dev.toView cited source
  15. [15]

    Anthropic scored the bug CVSS v4.0 8.7 (High).

    Reported Supported Source: dev.to write-up, citing NomaView cited source
  16. [16]

    Anthropic's docs say the Browser pane can "open static HTML files, PDFs, images, and videos from your project", next to the dev servers Claude starts to check its own changes.

    Reported Supported Source: Anthropic docs, as quoted by dev.toView cited source
  17. [17]

    Per Noma, Anthropic "treated the impact as equivalent to code execution on the host."

    Reported Supported Source: Noma, as reported by dev.toView cited source
  18. [18]

    The bug and the fix are in the Desktop app's preview renderer, so the version that matters is Claude Desktop's.

    Reported Supported Source: dev.to write-upView cited source
  19. [19]

    Neither Noma's post nor the press release reports exploitation in the wild.

    Reported Supported Source: dev.to write-upView cited source
  20. [20]

    Noma's post says Anthropic "took Noma's disclosure seriously from the start."

    Reported Supported Source: Noma's post, as reported by dev.toView cited source
  21. [21]

    Anthropic did not immediately respond to CSO Online's request for comment.

    Reported Supported Source: CSO Online, as reported by dev.toView cited source
  22. [22]

    The fix shipped 44 days after Noma's report.

    Derived Supported
  23. [23]

    The fix shipped 24 days after the July 24 bypass.

    Derived Supported
  24. [24]

    CSO Online reports Anthropic is preparing a GitHub Security Advisory and has requested a CVE. Noma's post lists both as pending, though its press release says they were posted in October.

    Reported Contested Source: CSO Online, Noma's post and Noma's press release, as reported by dev.toView cited source
  25. [25]

    As of October 14, none of these sources gives a CVE ID.

    Reported Contested Source: dev.to write-upView cited source

Sources

2 independent publishers whose own reporting we read for this story.

  1. dev.to

    2 articles · October 15, 2026

    Pad an HTML File Past 256KB and Claude Code Desktop's Preview Could Read Your SSH Keys
  2. letsdatascience.com

    1 article · October 15, 2026

    Noma tells LDS how a Claude Code preview could steal credentials

Topics and entities

Topics

Entities