Claude Code Desktop Flaw Let Malicious HTML Steal Developer Credentials

Noma Labs found a high-severity flaw in Anthropic’s Claude Code Desktop, dubbed SneakPeek, that let malicious HTML files steal local credentials and private keys through the app’s preview pane, Hackread reports. The attack could be triggered when a developer cloned a booby-trapped repository and asked Claude to review or edit an HTML file. Anthropic fixed the issue in Claude Desktop version 1.30096.1, delivered through automatic updates on Aug. 17.