Claude Code Desktop SneakPeek Vulnerability: Fixed and How to Respond

Claude Code Desktop's preview pane recently exposed a high-severity security vulnerability. An attacker only needs to trick a user into opening a specially crafted HTML file to steal SSH keys and cloud service credentials. The vulnerability, tracked as SneakPeek, has a CVSS score of 8.7 and has been fixed in Claude Desktop version 1.30096.1.

What Is the SneakPeek Vulnerability?

The core issue with SneakPeek lies in Claude Code Desktop's preview pane. This feature was originally designed to let developers view the rendered output of HTML files directly within the editor, but its access controls for local files had a serious flaw.

According to security research disclosures, an attacker can craft a malicious HTML file larger than 256KB. When a user opens and previews this file in Claude Code Desktop, the preview pane executes the malicious script embedded in the file, which can then read sensitive local files—including SSH private keys and cloud service credentials (such as access keys for AWS, GCP, and other platforms).

A CVSS score of 8.7 means this is a "high severity" vulnerability. An attacker does not need physical access to the target machine; they only need to use social engineering to get the user to open a seemingly normal HTML file, and credential theft is complete.

What is a CVSS score? CVSS (Common Vulnerability Scoring System) is a widely adopted industry standard for assessing vulnerability severity, maintained by the FIRST organization. Scores range from 0.0 to 10.0 and are typically divided into four levels: Low (0.1-3.9), Medium (4.0-6.9), High (7.0-8.9), and Critical (9.0-10.0). The score takes into account the attack vector (network, local, physical), attack complexity, required privileges, user interaction requirements, and impact on confidentiality, integrity, and availability. A CVSS score of 8.7 means the vulnerability can be exploited remotely over the network, requires no special privileges, and has a high impact on confidentiality—making it a classic high-severity vulnerability that should be prioritized for remediation. It's worth noting that CVSS reflects the technical severity of the vulnerability itself; actual business risk must also be assessed in combination with asset value and exposure surface.

Why are preview pane security risks particularly prominent? A preview pane is essentially an embedded rendering engine, typically implemented based on Chromium's WebView or similar components. Such components have full JavaScript execution capabilities by default, and in order to render local HTML files, they often have read access to the local file system. If strict sandbox isolation and same-origin policies are not enforced, malicious scripts can use fetch, XMLHttpRequest, or Electron's file:// protocol to read arbitrary local files. This is why HTML preview functionality is repeatedly a hotspot for security vulnerabilities in Electron-based applications.

Breaking Down the Attack Chain

Understanding the attack chain helps you determine whether you are at risk. The entire attack process can be broken down into several key stages:

Step 1: Craft a malicious HTML file. The attacker creates an HTML file larger than 256KB. This size threshold may be related to the preview pane's processing logic—above this size, the pane may trigger some kind of insecure fallback handling or bypass mechanism.

Step 2: Lure the user into opening it. The attacker sends this HTML file to a target developer through email, instant messaging, or code repositories. The file may be disguised as technical documentation, a code sample, or a design mockup.

Step 3: The preview pane executes malicious code. When the user opens the file for preview in Claude Code Desktop, the pane fails to properly isolate the script execution environment within the HTML, allowing malicious code to run.

Step 4: Read and exfiltrate credentials. The malicious script reads local SSH key files and cloud service credential configuration files, then sends this data to a server controlled by the attacker.

The most dangerous aspect of this chain is that the user does not need to click any "authorize" button at any point—merely previewing the file is enough to trigger the vulnerability.

Why is the threshold 256KB? In Electron and similar frameworks, file size thresholds are often related to memory buffering strategies. When an HTML file is small, the rendering process may load it using an in-memory data: URL or Blob object, where same-origin policies are stricter. But when a file exceeds a certain size (such as 256KB), the system may switch to loading it via a temporary file or the file:// protocol to save memory—and scripts under the file:// protocol often have more permissive local file access. The attacker exploits this privilege escalation caused by the switch in loading mechanisms, crafting a file just above the threshold to trigger the insecure path. Similar file-size-based bypass techniques are not uncommon in browser security research.

Fixed Version and Upgrade Recommendations

The good news is that this vulnerability has been fixed in Claude Desktop version 1.30096.1. If you are using Claude Code Desktop, it is recommended that you immediately check and upgrade to this version or later.

There are typically two ways to upgrade: first, through the application's built-in automatic update mechanism (if enabled); second, by downloading the latest installer from Anthropic's official channels and performing a manual overwrite installation. For enterprise environments, administrators are advised to force-push updates through centralized management tools to ensure all developers' clients are on a secure version.

If you cannot upgrade immediately, a temporary mitigation is to avoid previewing HTML files of unknown origin in Claude Code Desktop, especially files larger than 256KB. However, this is only a stopgap and should not replace a proper upgrade.

What Affected Users Should Do

If you previously opened a suspicious HTML file before the fixed version was released, or if you are unsure whether you were affected, the following steps can help you assess and minimize the damage:

Rotate all credentials. Immediately replace SSH key pairs and rotate access keys on all major cloud platforms. Do not change only one of them—the attacker may have obtained multiple credential files.

Check for anomalous access. Review cloud platform access logs for API calls from unfamiliar IPs or unusual time periods. For SSH, check whether unknown public keys have been added to ~/.ssh/authorized_keys.

Audit local file access records. On macOS, you can use fs_usage or third-party EDR tools to trace file access behavior; Linux users can check auditd logs. This helps confirm whether sensitive files were read.

Notify your security team. In an enterprise environment on a development machine, inform your security team promptly so they can assess lateral movement risk and take containment measures.

Why must credentials be rotated rather than just deleted? Once credential files have been read and exfiltrated, the attacker may have copied them to multiple locations. Simply deleting local files or changing passwords is not enough, because once SSH key pairs and cloud platform Access Keys are leaked, the attacker can use them anywhere. The correct approach is: first disable the old keys in the cloud platform IAM, create new key pairs, and then update all services and CI/CD pipelines that depend on those credentials. For SSH, generate new key pairs, deploy the new public keys to the target servers, remove the old public keys from authorized_keys, and check known_hosts for any anomalous entries.

What are EDR and auditd? EDR (Endpoint Detection and Response) is a category of enterprise-grade endpoint security software that can record process behavior, file access, and network connections for post-incident forensics. Linux's auditd is a kernel-level auditing framework that can monitor read operations on specific files (such as ~/.ssh/id_rsa) through auditctl rules. After configuring auditctl -w ~/.ssh/id_rsa -p r -k ssh_key_read, any attempt to read that file will be logged to /var/log/audit/audit.log, making it easier to confirm whether credentials have ever been accessed by a malicious process.

Implications for Developer Tool Security

The SneakPeek vulnerability exposes security blind spots that AI programming tools can easily overlook during rapid iteration. As a relatively new product, Claude Code Desktop's preview pane feature may have prioritized developer experience during design while giving insufficient consideration to permission boundaries for local file access.

Such vulnerabilities are not isolated incidents. As more and more AI programming assistants integrate file preview, code execution, and terminal access capabilities, the attack surface is rapidly expanding. Developers need to realize that a seemingly harmless "preview" feature may behind the scenes have permission to read the entire local file system.

For tool vendors, sandbox isolation should become a baseline requirement for preview-type features. HTML preview is especially dangerous because it inherently supports script execution. Isolating the preview environment from the main process, limiting file system access scope, and applying stricter policies to files above a certain size are all protective measures that should be enabled by default.

For individual developers, it is important to develop a "least privilege" habit: do not store unnecessary long-term credentials on development machines, rotate keys regularly, and remain vigilant about files of unknown origin. Security tools themselves also need to be used securely.

One-line Summary

Claude Code Desktop's preview pane exposed a high-severity vulnerability, SneakPeek, that can steal SSH keys and cloud credentials

Paragraph Summary

Claude Code Desktop's preview pane contains a high-severity security vulnerability, SneakPeek (CVSS 8.7). By tricking a user into opening a malicious HTML file larger than 256KB, an attacker can execute malicious scripts during preview, read and exfiltrate local SSH private keys and cloud service credentials such as AWS and GCP. The entire attack chain requires no user authorization click and can be triggered by the preview action alone, making it highly stealthy. The vulnerability has been fixed in Claude Desktop version 1.30096.1, and users should upgrade immediately. Affected users need to rotate all SSH keys and cloud platform access keys, check anomalous access logs and local file access records, and notify enterprise security teams. This incident also warns that preview-type features in AI programming tools must implement sandbox isolation and the principle of least privilege.