The vulnerable boundary was the Electron preview, not a model deciding to reveal secrets. When an agent viewed or edited an HTML artifact above the documented size threshold, the preview used a local file URL rather than an isolated data URL. The research report describes missing CSP enforcement and a request-filter gap for static files. The initial repair…
Inspect the ClaimsCase · DiggingBeagle record
Claude Desktop HTML preview could expose local developer files
SneakPeek reports that a crafted oversized HTML preview ran script against local file URLs and exfiltrated credentials; the researcher says the chain was patched in August.
Scope
Researcher proof of concept in Claude Code Desktop versions before 1.30096.1. The disclosure was published in October but describes testing and remediation in July and August; no verified criminal exploitation is claimed.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Evidence
- Grade B
- Remediation
- fixed reported
- AI role
- AGAINST AI
Basis and provenance
Noma researcher disclosure describes a proof-of-concept file read and exfiltration chain and reports the August 17, 2026 fix in version 1.30096.1. Browser access to the live primary page failed, but an indexed full-text account and reporter context were available. No independent production victim or independent patch retest was established.
Assessed Oct 16, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-SNEAKPEEK-FIX · CLM-SNEAKPEEK-EXFIL · CLM-SNEAKPEEK-TRIGGER · Noma Labs SneakPeek disclosure for Claude Code Desktop preview
At a glance
Previewing an artifact generated or selected by an agent can execute lower-trust code in the host UI. File-origin isolation and rendering restrictions must be enforced on every size-dependent path.
Read the implicationsNo external attack or victim loss was independently established. The vulnerability was fixed before its October public disclosure, according to the researcher. The first-party disclosure was available as an indexed article, but direct live fetch through the accessible browser failed, preventing independent verification of its complete current page and any…
Limits and uncertaintyFull account
The vulnerable boundary was the Electron preview, not a model deciding to reveal secrets. When an agent viewed or edited an HTML artifact above the documented size threshold, the preview used a local file URL rather than an isolated data URL. The research report describes missing CSP enforcement and a request-filter gap for static files. The initial repair was bypassed with a blob-backed Web Worker. The researcher states that Claude Desktop 1.30096.1 closed the paths by August 17. The delivery path matters: a developer could clone a repository, ask the agent about a seemingly ordinary HTML coverage report, and receive a preview that executed attacker-authored code. The 256 KB threshold selected a different renderer origin, so testing only small previews would not exercise the flaw. The report also documents a failed partial fix: filtering ordinary file fetches did not close the blob-backed Worker route. This was a controlled disclosure, not evidence that attackers had already stolen user credentials in production.
Mechanism and trust boundary
- 01
Victim inspects a cloned repository
A local coding agent reads or edits an attacker-controlled HTML coverage report.
Boundary: untrusted repository content to desktop preview
- 02
Oversized preview executes JavaScript
The large-file path enters a file URL origin without equivalent script restrictions.
Boundary: HTML artifact to local file origin
- 03
Local secrets become readable
Requests from the preview can resolve other local file paths and leak results outward.
Boundary: preview sandbox to developer filesystem and network
Timeline
- Oct 14, 2026disclosure
Public disclosure
Claims & evidence
CLM-SNEAKPEEK-FIXThe researcher reports that the initial file-request patch was bypassed using a blob-backed Web Worker and that a complete update shipped in Claude Desktop 1.30096.1 on August 17, 2026.supported
Basis: reported finding
- supportsNoma Labs SneakPeek disclosure for Claude Code Desktop previewprimary disclosure
Bypassing the Fix and Disclosure Timeline, August 17 entry
CLM-SNEAKPEEK-EXFILIn the controlled proof of concept, an attacker-authored repository report caused the preview renderer to read local developer credential files and send their contents off host.supported
Basis: reported finding
- supportsNoma Labs SneakPeek disclosure for Claude Code Desktop previewprimary disclosure
Vulnerability Proof of Concept, One Question, Full Compromise
CLM-SNEAKPEEK-TRIGGERNoma Labs reports that HTML previews exceeding 256 KB were loaded through file URLs without the CSP used for smaller previews, enabling JavaScript in an attacker-provided report to run.supported
Basis: reported finding
- supportsNoma Labs SneakPeek disclosure for Claude Code Desktop previewprimary disclosure
The Sandbox Bypass, file size and file:// paragraphs
Implications
Previewing an artifact generated or selected by an agent can execute lower-trust code in the host UI. File-origin isolation and rendering restrictions must be enforced on every size-dependent path.
Controls and mitigations
- Use Claude Desktop 1.30096.1 or later according to Noma’s remediation chronology.
- Treat HTML previews from unfamiliar repositories as active content, not passive model output.
- For desktop agent products, apply content security policy and local-file isolation consistently to both small and oversized previews, including nested workers and alternate request APIs. This is a design-level recommendation, not a claim that every implementation has the same flaw.
- Treat automatic preview of repository-supplied active content as a separate trust boundary from an agent reading source text. Do not rely on a model refusal to prevent script execution in a desktop renderer.
Unknowns and contradictions
- No external attack or victim loss was independently established.
- The vulnerability was fixed before its October public disclosure, according to the researcher.
- The first-party disclosure was available as an indexed article, but direct live fetch through the accessible browser failed, preventing independent verification of its complete current page and any later editorial changes.
- No independent exploit reproduction or observed victim compromise was established in this Enrich session.
Sources and citation
Material revision history
- Oct 16, 2026 · Canonical change recorded · new in release · revision 157