Claude Code Desktop's preview pane ran scripts in HTML files over 256KB
Noma Security reported that Claude Code Desktop's preview ran scripts in HTML files over 256KB, a flaw Anthropic fixed in 1.30096.1. Those scripts could read SSH keys, AWS credentials and GitHub tokens, so previewed repo files should be handled as untrusted code.
The Engineer · Build desk
Timeline: July 4, Noma reports the chain to Anthropic with a proof of concept. July 24, Anthropic's patch blocking fetch() to file:// goes back for retest. August 17, the fix ships in Claude Desktop 1.30096.1. October 14, 2026, Noma publishes SneakPeek.
| Date | Event | Claim |
|---|---|---|
| July 4, 2026 | Noma reports the chain to Anthropic with a proof of concept | 11 |
| July 24, 2026 | Anthropic's patch blocking file:// fetch() goes back for retest | 12 |
| August 17, 2026 | Fix ships via auto-update in Claude Desktop 1.30096.1 | 3 |
| October 14, 2026 | Noma Security publishes the research, called SneakPeek | 1 |
What happened
- Files under 256KB loaded as data: URLs with a script-src 'none' policy and an opaque origin, so embedded scripts were blocked, according to Noma.
- Larger files were written to a temp file and loaded over file://, a path that never got the policy, and in Chromium that origin can use fetch() to read other local files.
- A request filter that blocked file:// reads was active only while the pane proxied a dev server, so it did nothing for a static HTML file rendered from disk.
- Noma's proof of concept needs a cloned repo with a padded coverage report and a request to review it, and Noma says no permission prompt appears.
- Anthropic scored the flaw CVSS v4.0 8.7 (High).
Why it matters
- Who's exposed exposure The path from a stranger's repo to a developer's credentials is demonstrated in a proof of concept, but neither Noma's post nor its press release reports exploitation in the wild.
- Who has to decide decision The bug sits in the Claude Desktop app's preview renderer, so that app's version is the one teams have to check, and any machine where auto-update is paused or blocked is the one most likely to be behind.
- What doesn't add up contradiction Noma's post lists the advisory and CVE as pending while its press release says they were posted in October, so patch tracking has no identifier yet.
Anthropic's first fix, on July 24, blocked fetch() and XMLHttpRequest to file:// from the page and went back for a retest [12]. The same day, Noma moved the fetch() into a Web Worker created from a blob: URL, a context the filter did not cover [13]. In our view that fix was a denylist on two named APIs, and a Worker sat outside it.
Anthropic confirmed the bypass in early August and started a deeper fix [14]. It shipped on August 17 [3], 44 days after Noma's July 4 report [22][11] and 24 days after the bypass [23]. The sources do not describe what the deeper fix changed.
The original bug is the more portable lesson. The researcher who wrote it up told CSO Online: "The protections were real, they just didn't cover every path." [7] The 256KB cutoff is specific to this app. What transfers is any branch where a property of the input, such as size, type or origin, selects a loader. Each branch needs the same policy, and the cheap test is to push one hostile file down every path.
Per Noma, Anthropic "treated the impact as equivalent to code execution on the host." [17] Noma's post says the company "took Noma's disclosure seriously from the start." [20]
Anthropic's docs say the Browser pane can "open static HTML files, PDFs, images, and videos from your project" next to the dev servers Claude starts to check its own changes [16]. So the input is the repo itself. We'd handle a previewed file from a repo you did not write the way you would handle a script from it.
On versions, the dev.to write-up notes that the bug and the fix are in the Desktop app's preview renderer, so Claude Desktop's version is the one that counts [18]. The target is 1.30096.1 or later [3].
According to CSO Online, Anthropic is working on a GitHub Security Advisory and has asked for a CVE [24]. Noma's post shows the advisory and the CVE as still pending, while its press release says they were posted in October [24]. As of October 14, none of the sources gives a CVE ID [25]. Anthropic did not immediately respond to CSO Online's request for comment [21].
What to watch
- Publication of the GitHub Security Advisory and a CVE ID.
- Anthropic's account of what the deeper fix changed beyond blocking fetch() and XMLHttpRequest to file://.
- Any report of exploitation before the August 17 fix.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence58
- Adoption
- Not scored
- Hype gap+15
- Incentives40
- Confidence68
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Noma Security published the research, which it calls SneakPeek, on October 14, 2026.
- [2]
The bug was in the HTML preview of the Claude Code Desktop app, not in a model.
- [3]
The fix shipped on August 17 and reached users through auto-update in Claude Desktop 1.30096.1, per Noma's timeline.
- [4]
Files under 256KB loaded as data: URLs with a Content Security Policy of script-src 'none' and an opaque origin, so embedded scripts were blocked.
- [5]
Files over 256KB were written to a temp file and loaded as file:// URLs. That path never got the CSP, and in Chromium a page on a file:// origin could use fetch() to read other local files.
- [6]
A request filter did block file:// reads, but only when the pane was proxying a dev server. It was not active when the pane rendered a static HTML file from disk.
- [7]
The researcher who wrote it up told CSO Online: "The protections were real, they just didn't cover every path."
- [8]
In Noma's proof of concept, an attacker publishes a repository with a coverage report padded past 256KB with a script inside; the victim clones it and asks Claude to review a file; the preview pane renders it, the script runs, and Noma says no permission prompt appears.
- [9]
The script reads files such as SSH keys, AWS keys, npm and GitHub tokens, Kubernetes credentials, Docker registry auth and Claude's own OAuth tokens, and sends them out with navigator.sendBeacon().
- [10]
Noma's TL;DR adds that the payload could also get the user's real IP address through WebRTC.
- [11]
On July 4, Noma reported the chain to Anthropic with a proof of concept.
- [12]
On July 24, Anthropic's patch, which blocked fetch() and XMLHttpRequest to file:// from the page, went back for a retest.
- [13]
The same day, Noma moved the fetch() into a Web Worker created from a blob: URL, a context the filter did not cover.
- [14]
In early August, Anthropic confirmed the bypass and started a deeper fix.
- [15]
Anthropic scored the bug CVSS v4.0 8.7 (High).
- [16]
Anthropic's docs say the Browser pane can "open static HTML files, PDFs, images, and videos from your project", next to the dev servers Claude starts to check its own changes.
- [17]
Per Noma, Anthropic "treated the impact as equivalent to code execution on the host."
- [18]
The bug and the fix are in the Desktop app's preview renderer, so the version that matters is Claude Desktop's.
- [19]
Neither Noma's post nor the press release reports exploitation in the wild.
- [20]
Noma's post says Anthropic "took Noma's disclosure seriously from the start."
- [21]
Anthropic did not immediately respond to CSO Online's request for comment.
- [22]
The fix shipped 44 days after Noma's report.
- [23]
The fix shipped 24 days after the July 24 bypass.
- [24]
CSO Online reports Anthropic is preparing a GitHub Security Advisory and has requested a CVE. Noma's post lists both as pending, though its press release says they were posted in October.
- [25]
As of October 14, none of these sources gives a CVE ID.
Get this ledger inside ChatGPT. Ask about any of our stories and the answer brings its figure, each claim’s verdict and the sources. Free, no account.
Sources
2 independent publishers whose own reporting we read for this story.
- dev.toPad an HTML File Past 256KB and Claude Code Desktop's Preview Could Read Your SSH Keys
2 articles · October 15, 2026
- letsdatascience.comNoma tells LDS how a Claude Code preview could steal credentials
1 article · October 15, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.
Topics
- Developer and source-code supply chain securityFollow
- Vulnerability DisclosureFollow
- Credential ExfiltrationFollow
- AI Coding Assistant SecurityFollow