Skip to content
High-Risk Vulnerability in Claude Code Exposes Developers' Secrets

High-Risk Vulnerability in Claude Code Exposes Developers' Secrets

First seen 14 Oct 2026, 14:38 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 14, 2026 at 16:34 UTC
  • •The SneakPeek vulnerability allows arbitrary JavaScript execution in Claude Code's preview pane.
  • •Sensitive data such as API keys and SSH credentials can be exfiltrated without user interaction.
  • •Anthropic has released a security update to mitigate the identified vulnerabilities.

Noma Labs has identified a critical vulnerability, dubbed SneakPeek, in Anthropic's Claude Code Desktop app that allows attackers to execute arbitrary JavaScript via the application's preview pane. This flaw, rated CVSS 8.7, enables the exfiltration of sensitive data such as AWS credentials, SSH keys, and OAuth tokens when developers request file reviews. The vulnerability arises from three architectural issues: improper handling of file sizes over 256KB, unrestricted access to local files, and an inactive request filter. Following the discovery, Anthropic collaborated with Noma Labs to implement a comprehensive security update that addresses all identified attack vectors. The vulnerability has not been assigned a CVE ID yet, but a GitHub Security Advisory is forthcoming. This incident highlights the growing risks associated with AI tools in software development environments.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-14
Noma Labs discloses SneakPeek vulnerability
Noma Labs reveals a high-severity vulnerability in Claude Code Desktop that allows data exfiltration through the preview pane.
CSOonline
2026-10-14
Anthropic releases security update
Following the disclosure, Anthropic issues a comprehensive update to resolve the SneakPeek vulnerability.
PRnewswire

More articles in this cluster (3)

Following this threat?

Track Anthropic in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (15)

1 / 4

Common questions

What data is at risk?
Sensitive data such as AWS credentials, SSH keys, and OAuth tokens can be exfiltrated.
Has a CVE been assigned?
No CVE ID has been assigned yet, but a GitHub Security Advisory is expected soon.
What should developers do now?
Developers should apply the latest security update from Anthropic to mitigate the vulnerability.