SneakPeek: How a Preview Pane Flaw Exposes Team Credentials

In 2026, 68% of organizations reported lacking visibility into the AI tools their developers were actually using, while spend on AI coding tools is projected to top $13 billion—compounding at more than 60% annually. That blindness has a name: the ‘SneakPeek’ vulnerability. What Claude Code’s zero-click flaw means for your team’s credential hygiene is straightforward—every file an agent reads is now an execution vector, and your developers’ ambient credentials are the payload.

What is the SneakPeek vulnerability, and why does a 256KB threshold matter?

Noma Labs discovered an exploit chain in Claude Code Desktop’s preview pane that achieves arbitrary file read via unrestricted JavaScript execution, with the payload disguised as a coverage report in a public repository. The delivery mechanism is almost boring in its simplicity: a developer clones a repo, asks Claude Code to inspect an HTML file, and the preview pane renders it automatically. Simply asking Anthropic’s Claude Code to review an HTML file could hand attackers access to a developer’s machine, cloud credentials and software development environment.

The root cause is a file-size threshold. Files under 256KB load as data: URLs, which restrict what embedded scripts can access. Files over 256KB are written to a temp file and loaded through file://, a path that lacked CSP coverage and where a request filter was inactive when static HTML files were rendered directly from disk. Anthropic sandboxes the preview pane with three defenses: a Content Security Policy (CSP) blocking script execution, origin isolation limiting rendered content access, and a request filter controlling which resources the renderer can fetch. Noma Labs researchers bypassed all three.

Because the preview pane loads files above 256KB via file:// URLs, the payload gets same-origin access to the victim’s entire local filesystem. The SneakPeek exploit silently exfiltrates sensitive credentials and secrets including API keys, SSH private keys, cloud credentials, Claude’s own OAuth tokens, and the victim’s real IP address via WebRTC. Once rendered, the script could read local files and exfiltrate sensitive data including AWS credentials, GitHub secrets and SSH private keys to a remote server. A bug in Claude Code Desktop’s preview pane can allow adversaries to quietly steal credentials from developers, including SSH private keys, AWS credentials, and Claude OAuth tokens. Noma Security’s SneakPeek exploit used malicious JavaScript in large HTML files to bypass Claude Code Desktop’s sandbox protections and access sensitive local information. Anthropic scored Noma Labs’ discovery as CVSS 8.7 (High) and treated the impact as equivalent to code execution on the host.

The patch history is messy. Anthropic issued an initial SneakPeek patch on July 24, 2026 that blocked direct file reads from the preview’s main page context. Moving the file-reading code into a Web Worker created from a blob: URL bypassed that patch because the worker ran in a context the patch did not cover. On August 3, 2026, Anthropic confirmed the first fix was incomplete. Noma says Claude Desktop 1.30096.1 and later fixed the flaw, with the final fix shipped August 17, 2026.

How does a preview pane become a credential-theft vector?

I’ve been calling this pattern Trust Boundary Collapse: passive, trusted developer inputs get transformed into active execution contexts without a human approval boundary. SneakPeek is a textbook case. The code ran in the preview renderer, not as an action by Claude’s AI agent. That distinction matters because the JavaScript ran in an Electron-based Chromium renderer, putting execution outside actions independently selected by the AI agent. Model-level safeguards and agent activity logs may not capture the script’s file reads or outbound connections.

This isn’t an isolated bug. Claude Code validated that a target file path resided within the project working directory at permission-check time, but re-resolved the path at write time without repeating that validation, allowing a TOCTOU symlink attack for arbitrary file write. Claude Desktop on Windows used uv_spawn to execute git.exe without specifying an absolute path, causing the process to search the current working directory before system directories, enabling remote code execution via a malicious git.exe in a cloned repository. The plugin install flow checked out a marketplace’s pinned commit SHA using git checkout without verifying that the resulting HEAD matched the pinned SHA, allowing installation of attacker-controlled code. If you think hash-pinning solves this, our teardown of Claude Code plugin security after the Plugin4Shell flaw explains why it doesn’t.

Even managed settings failed. Claude Code selected an API key stored by Claude Code ahead of the user’s valid Claude Enterprise or Team sign-in when fetching the organization’s server-managed settings, causing managed settings not to be applied. Each of these follows the same shape—data becomes code, and the agent’s credentials do the rest. The model’s intelligence is irrelevant when the harness architecture is the vulnerability.

Why do AI coding agents keep failing at credential hygiene?

Six research teams disclosed exploits against Codex, Claude Code, Copilot, and Vertex AI over a nine-month period, and every exploit followed the same pattern where an AI coding agent held a credential, executed an action, and authenticated to a production system without a human session anchoring the request. BeyondTrust proved that a crafted GitHub branch name could steal Codex’s OAuth token in cleartext. Adversa found that Claude Code silently ignored its own deny rules once a command exceeded 50 subcommands. CVE-2026-33068 involved Claude Code resolving permission modes from .claude/settings.json before showing the workspace trust dialog, allowing a malicious repo to set permissions.defaultMode to bypassPermissions so the trust prompt never appeared.

The CI/CD pipeline is just as exposed. Microsoft Threat Intelligence discovered that Anthropic’s Claude Code GitHub Action could expose CI/CD workflow secrets when AI agents process untrusted GitHub content, with the Read tool accessing /proc/self/environ to read the workflow’s ANTHROPIC_API_KEY. Mozilla’s 0DIN team demonstrated that a clean-looking GitHub repository could lead Claude Code to fetch and run a DNS-hosted payload, opening a reverse shell on a developer’s machine. A study of agentic coding editors analyzed 314 prompt-injection payloads across 70 MITRE ATT&CK techniques and found success rates as high as 84% for malicious command execution against GitHub Copilot and Cursor.

Even the MCP ecosystem isn’t safe. GitLab’s Threat Research Group found a critical server-side template injection in Serena that executes arbitrary code in the Serena process when a developer opens a repository containing a malicious .serena/project.yml file. MCP servers run on the developer’s own machine with access to SSH keys, cloud provider credentials, .env files, browser sessions, and internal network resources, so compromising the server process compromises the developer’s entire local environment. And a security researcher with colleagues at Johns Hopkins University demonstrated ‘Comment and Control’, where a malicious instruction in a GitHub pull request title caused Anthropic’s Claude Code Security Review action to post its own API key as a comment. Anthropic classified it as CVSS 9.4 Critical, and its own system card acknowledged that Claude Code Security Review is ‘not hardened against prompt injection’.

What does the broader ecosystem look like for teams evaluating AI coding tools?

If you’re evaluating AI coding tools right now, you’re really choosing between different trust models. Claude Enterprise uses a seat fee that covers access only, with all usage billed separately at API rates and no per-seat usage limits or included token allowance. It includes audit logs, SCIM, custom data retention controls, a Compliance API, an Analytics API, customer-managed encryption keys, and US-only inference. Serena takes a different approach as an MCP server that connects Claude, Cursor, Copilot, and other AI assistants to a local codebase, providing semantic code navigation and refactoring tools—but as GitLab showed, that local reach is also its risk profile. Meanwhile, agentic editors like GitHub Copilot and Cursor remain popular despite the 84% prompt-injection success rate documented in the study of 314 payloads.

Tool	Pricing	Key Security Features	Target Audience
Claude Enterprise	Seat fee + usage billed at API rates; no per-seat limits	Audit logs, SCIM, Compliance API, customer-managed keys, US-only inference	Organizations needing compliance and scalable AI
Serena (MCP server)	—	Semantic code navigation, refactoring, local MCP integration	Developers pointing AI assistants at local codebases
GitHub Copilot / Cursor	—	Agentic editing subject to prompt injection (84% success rate in study)	Developers using AI-assisted coding

A 50-developer team’s Claude Enterprise seat cost cannot be projected because the research does not state the per-seat monthly price for the Enterprise plan. That gap matters when you’re budgeting, but it matters less than the architectural question: which of these tools treats your credentials as the asset they are? Claude Security is now available in public beta to Claude Enterprise customers, using Claude Opus 4.7 to scan code for vulnerabilities and generate proposed fixes. Useful for your own code, but it won’t stop a poisoned HTML file from executing in a preview pane.

How should you harden credential hygiene before the next zero-click flaw?

The Australian Signals Directorate advises maintaining an inventory of AI accounts, service identities and credentials, applying least-privilege access, requiring phishing-resistant MFA, and securing API keys using approved secrets-management services. That’s the baseline. But SneakPeek proves you need to go further: treat every file an AI agent reads as untrusted executable content, because the data proves attackers weaponize the agent’s own trusted workflow to exfiltrate ambient credentials rather than attacking the model directly.

Start with visibility. In 2026, 68% of organizations reported lacking visibility into the AI tools their developers were actually using, and 57% of employees reported using AI coding tools without formal IT approval. You can’t secure what you can’t see. Machines now outnumber human identities 109 to 1, and because agents frequently operate using human credentials, distinguishing developer action from autonomous agent action becomes nearly impossible. In one documented AI-enabled intrusion chain, an agent executed 17,600 actions in 4.5 days creating a timeline no human-enabled SOC can manually govern.

Then constrain the blast radius. The Mini Shai-Hulud worm targets npm, PyPI, and other third-party registries and includes a module that scans the developer’s home directory for AI coding tool configuration files by name, injecting hook commands for persistence each time a developer starts an AI coding session. AI coding assistant configuration files such as settings.json hooks and .cursorrules sit at the intersection of three trust relationships: the developer trusts them as config, the IDE executes them automatically, and the LLM treats them as authoritative instructions. If you haven’t already, read our guide on hardening AGENTS.md and agent config files against poisoning—it’s the same trust-boundary problem wearing a different filename.

For teams building auth flows with these tools, our post on auth patterns and costs with Claude Code covers why you need to specify CSRF, PKCE, and session guards manually. The Enterprise plan’s audit logs and Compliance API help with attribution after the fact, but they don’t prevent the initial credential theft. The open question is whether vendors will ever treat the harness as the attack surface it clearly is. Anthropic ships advanced vulnerability discovery capabilities while its own products remain vulnerable to basic harness attacks. Until that contradiction resolves, your credential hygiene is the only control that matters.