How Claude Code’s 256KB blind spot put developers' secrets in the preview pane

A vulnerability in Anthropic’s Claude Code desktop app could let malicious JavaScript embedded in an HTML file execute without user interaction through the app’s automated preview pane, CSO reports. The flaw, dubbed SneakPeek and disclosed by Noma Security, could expose a developer’s machine, cloud credentials and development environment.