Noma Labs details SneakPeek, a patched Claude Code Desktop preview flaw that leaked local secrets
A poisoned HTML file padded past 256KB in a public repo could run JavaScript in Claude Code Desktop's preview pane when you asked Claude to look at it, silently reading SSH keys, cloud credentials, and Claude's own OAuth tokens. Anthropic rated it CVSS 8.7, and the final fix shipped Aug 17 in Claude Desktop 1.30096.1 and later, so make sure your app has updated.
