Claude Code Flaw Let Malicious Files Steal Developer Credentials Without a Click
Source
How Claude Code's 256KB blind spot put developers' secrets in the preview paneNoma Security / Anthropic
What happened
Noma Security published research on October 14, 2026, disclosing a vulnerability it named SneakPeek in Anthropic's Claude Code desktop application. It was rated 8.7 on the industry-standard severity scale used to rank security flaws. The research, covered in How Claude Code's 256KB blind spot put developers' secrets in the preview pane, found that HTML files larger than 256 kilobytes would automatically load inside the app's built-in preview pane. This used a less-restricted file pathway, bypassing the app's content security rules. That loading behavior allowed malicious JavaScript code embedded in such a file to run silently. It could transmit cloud credentials, SSH authentication keys, and GitHub secrets to an external server without anyone clicking anything. Anthropic released an initial patch, but Noma demonstrated that a separate browser feature called Web Workers could be used to bypass it; Anthropic subsequently deployed a deeper architectural fix. The incident sits alongside a pattern of credential and data exposure risks in AI developer tools. These include the GitHub Copilot CLI flaw that leaked developer secrets via hidden web page instructions and GitSpawn, which hit seven AI coding agents by exploiting repository trust.
Why it matters
- ·AI coding tools now sit at the intersection of developer access and cloud infrastructure. A credential stolen through Claude Code can give an attacker the same access as the developer who installed it. This makes the tool a high-value attack target. Compliance and security teams must explicitly cover such tools in their third-party AI risk assessments.
- ·The patch bypass shows that a vendor's first fix may not close the full exposure. Compliance programs that treat a vendor patch as the end of the risk management cycle need to add a step. That step is verifying that the underlying design flaw, not just the immediate symptom, has been resolved before declaring the risk closed.
- ·Organizations with developers using AI coding assistants likely have no inventory of which tools are installed, what system access those tools have, or what credentials pass through them. This incident creates an obligation to close that visibility gap, particularly for firms subject to cloud security or data protection requirements.
Stay ahead of stories like this
Get every Global AI governance development like this one, plus the rest of the week's developments. Every Thursday.
Recent issues
- Three separate incidents this week each created a new compliance action item: verify your AI vendors' data sourcing, demand agent monitoring coverage guarantees, and audit trusted app identities in your cloud environment.29 Oct
- Regulators, litigants, and attackers are all moving faster than most organizations' AI governance frameworks, shifting leverage away from deployers and toward those who can prove control, accountability, and honest disclosure.21 Oct
Free every Thursday. Unsubscribe anytime.
Governance controls affected
What to do now
- ☐Ask your IT or engineering team to produce a current list of all AI coding assistants installed on developer machines, including Claude Code, and confirm each one is running the latest patched version.
- ☐Ask your security team whether any cloud access keys, SSH keys, or code-hosting tokens that were active during the exposure window have been rotated, and set a deadline if they have not.
- ☐Update your third-party AI tool risk assessment process to require a review of how a tool handles local file previews and what system credentials it can access, not just what data it sends to the vendor's servers.
- ☐Add a step to your patch-management process for AI developer tools that requires confirmation from the vendor that an architectural root cause has been fixed, not just that a surface-level patch was issued.
- ☐Review your acceptable-use policy for AI developer tools to clarify which tools are approved for use in environments where production credentials or sensitive keys are present, and communicate any restrictions to engineering teams.
What to watch next
Compliance teams should monitor whether Anthropic or other AI coding tool vendors publish updated security documentation or independent verification of their architectural fixes following the patch bypass. The broader pattern of credential exposure across AI developer tools includes the Plugin4Shell flaw that broke approved-plugin controls across four major AI coding agents. This pattern suggests the risk is becoming a recurring compliance obligation rather than a one-time patch event. Regulatory bodies have not yet addressed AI coding tool security as a distinct category. Firms operating under cloud security frameworks or data protection obligations should not wait for specific guidance before tightening controls.