The report
Noma Labs published its SneakPeek research on October 14, describing how an attacker-controlled HTML report in a cloned repository could become executable content inside Claude Code Desktop. In the researcher's proof of concept, an oversized preview followed the file:// loading path, missed protections applied to smaller previews, read local credential material and sent it to an external destination. The critical trust transition occurred in the desktop preview renderer, after the agent interacted with repository material.
The initial remediation blocked direct local-file requests, but Noma reports a later bypass using a blob-backed Web Worker. Its disclosure timeline places the completed fix in Claude Desktop version 1.30096.1 on August 17, 2026. Publication in October should not be mistaken for the date of the final fix or evidence of ongoing exploitation. The SneakPeek case preserves that distinction.
The lesson concerns executable previews, not an agent receiving a malicious chat message. A repository file that looks like a routine test report can acquire local filesystem access when the host application renders it under the wrong origin and content policy. Checking the desktop version matters more than relying on a refusal from the language model. The public research establishes a controlled exploit chain; it does not establish criminal use against real developers.
Source: Noma Labs disclosure.