Anthropic 'SneakPeek' Flaw Is a Silent Zero-Click Threat
3 Min Read
Source: Seregraff via Getty Images
With no prompt, no click, and no sandbox defenses, a high-severity bug in Anthropic's Claude Code Desktop lets an adversary steal deeply sensitive files from software developer machines.
It's patched now, but it wasn't easy.
The first fix for the vulnerability, dubbed "SneakPeek," was bypassed by Noma researchers who first discovered the bug. That sent Anthropic's team back into the code to make deeper architectural fixes. Anthropic and Noma collaborated on the disclosure and fix, according to the Noma researchers.
The vulnerability impacts Claude Code Desktop's automated preview pane, which provides coders with real-time previews of HTML files the platform has generated or modified. Three specific flaws in the preview's architecture, when chained together, bypassed all built-in sandbox protections that developers using the platform assumed were in place, according to Noma. The three specific gaps researchers identified included missing content security policy, unrestricted origin access, and inactive request filtering.
Related:Malicious Linux Implants Mimic Asian Mail Security Products
"An attacker could deploy a standard-looking public code repository containing an HTML file padded past 256KB with an embedded malicious script," Eli Ainhorn, senior AI vulnerability researcher at Noma, wrote in the report. "When a developer asked Claude Code to review or edit the file, the preview pane rendered the document automatically, triggering silent background exfiltration of credentials."
The malicious script could then steal AWS and GitHub credentials, API keys, and Claude's own OAuth tokens, along with any others on the host machine — all without an interaction from the developer believing they are working in a protected, sandboxed environment.
AI Models Struggle with Security
There are likely to be more of these stealth vulnerabilities occurring in environments assumed to be secure, like Claude's Code Desktop preview sandbox, according to Ainhorn.
"I think the announcement from Satya (Nadella) this week on X, and Anthropic's statement today, in addition to vulnerabilities we've been seeing over the past few months, all point clearly in that direction."
Ainhorn is referring to Microsoft CEO Nadella's article calling for an AI cybersecurity "emergency brake" and guidance to "treat models as compromised," as well as Anthropic's ominous study showing bots can self-replicate to form future AI worm attacks through makeshift IoT device networks.
"The companies you rely on to create and supply the model cannot also be your security provider," Ainhorn adds. "Or they can provide a baseline, but they can't be relied on to be your only security provider."
Related:Russia's Star Blizzard Ditches ClickFix to Widen Phishing Net
The "SneekPeek" vulnerability was first reported to Anthropic on July 4, and the company pushed out a fix on July 9, according to Noma's timeline. After a July 24 re-test, Noma found a bypass, and a final patch was deployed on Aug. 17 ahead of this month's advisory.
The best protections include an aggressive, automated patching program, and a refinement of developer behaviors, according to Ainhorn.
"Coding applications need to be kept updated, and long-lived credentials need to be kept off developer machines," Ainhorn says, "but robust security solutions that provide both holistic visibility and runtime protection are no longer nice to have, they have become the de facto standard for every company with autonomous agents in production."
About the Author
Senior Editor, Dark Reading
Award-winning journalist and senior editor at Dark Reading reporting across diverse media platforms, including podcasts and video. Becky is passionate about delivering insightful, high-quality information and storytelling that informs and engages the cybersecurity community. Her specific focus is on the intersection of cybersecurity and public policy and its impact on the enterprise.
As the host and producer of the recently Azbee-recognized Dark Reading Confidential podcast, she presents compelling conversations with industry leaders, exploring the latest trends and challenges in cybersecurity. Becky is also the moderator Dark Reading's popular editorial webinars, and oversees Dark Reading's Commentary section, curating expert perspectives intended to drive meaningful dialogue. Additionally, she is the host of Dark Reading's Black Hat News Desk, delivering timely and in-depth coverage right from the heart of one of the industry's most important events.
Beyond editorial responsibilities, Becky is a regular writer and reporter for Dark Reading, contributing articles that delve into the evolving cybersecurity landscape.
Prior to joining Dark Reading, Becky honed her expertise as a cybersecurity reporter for Threatpost, where she covered breaking news and emerging threats in the digital security space.
She holds a BA in political science from the University of Arizona, and a BA in journalism from the Walter Cronkite School of Journalism at Arizona State University.