DEV Community

Anoymask
Anoymask

Posted on

SneakPeek: Claude Code Desktop Preview Can Exfiltrate Local Secrets After Repository Cloning and a File Review Request

#security #threatintel

1. Basic Information

2. One-Sentence Summary

In Noma's test environment, when Claude Code Desktop previewed poisoned HTML files larger than 256KB from a repository, a chain of issues involving a file:// origin, missing CSP, and an inactive request filter allowed SSH keys, AWS/GitHub/npm tokens, and Kubernetes credentials to be exfiltrated using sendBeacon.

3. Attack Flow

Attack and Exploitation Vectors

  1. An attacker places a poisoned coverage HTML file larger than 256KB in a repository that appears to be a normal project.
  2. A developer clones the repository and asks Claude to review the files.
  3. The preview pane automatically renders the file using a file:// URL and executes embedded JavaScript without a Content Security Policy (CSP).
  4. A script or Web Worker reads local credential files and exfiltrates them externally using sendBeacon.

4. Attacker Position and Prerequisites

  • A supply-chain attacker capable of placing malicious HTML into a public repository.

5. What Victims and Administrators See

Victim Side

  • It appears as a normal coverage report review with no additional prompts or permission requests displayed.

Administrator Side

  • Inference: Temporary HTML files, credential-file access, and traffic to external destinations are potential investigation leads. The traces available depend on the monitoring products and their configuration.

6. Success and Failure Conditions

Success Conditions

  • An unpatched version of Claude Code Desktop (the earliest affected version is unknown; Noma reports a fix in version 1.30096.1 and later).
  • Triggering the preview by having Claude read an HTML file larger than 256KB.
  • Egress traffic permitted to the attacker's endpoint.

Failure Conditions and Defensive Limits

  • Verify that Claude Desktop version 1.30096.1 or later, which Noma identifies as fixed, is installed. Until the fix is applied, avoid previewing untrusted HTML.
  • Inference: Reducing long-lived secrets on endpoints limits potential impact; monitoring egress traffic and credential access supports detection. Neither measure guarantees prevention of arbitrary file reads.

7. What Happens If the Attack Succeeds

  • Exfiltration of SSH keys, cloud credentials, source-control tokens, and cluster credentials.
  • Inference: Stolen credentials could enable subsequent compromise of repositories, cloud environments, or Kubernetes clusters if they remain valid and have the necessary permissions.

8. Observable Logs

  • Email: Inference: If the developer was directed to the repository by email, retained messages may identify the sender and repository link.
  • Proxy / SWG / DNS: Inference: If HTTP logging is enabled on a proxy or secure web gateway, logs may show the destination and timing of an external POST; DNS logs may show name resolution. These records alone do not identify a sendBeacon call.
  • Endpoint / EDR: Inference: Where file-access telemetry is collected, Claude Desktop processes can be correlated with access to credential files. Whether file:// URLs or preview activity are recorded depends on the product and configuration.
  • Identity / IdP: Inference: Authentication audit logs can help investigate suspicious authentication associated with the targeted credentials. Not all API token usage appears in IdP logs.
  • SaaS / Cloud: Inference: If GitHub or cloud audit logging is enabled, logs may show operations performed using a token. Whether exfiltration succeeded must be established separately.
  • Network: Inference: Telemetry that links processes to network connections may help correlate Electron processes with traffic to external destinations.

9. Scope of Success Confirmation

Information Exfiltration or Session Compromise Confirmed

  • Scope: A proof of concept (PoC) in Noma's test environment.
  • Basis: Public disclosure: Noma reported arbitrary file reads and credential exfiltration in its laboratory PoC. This is distinct from confirmation of in-the-wild exploitation or subsequent compromise.

Internal Evaluation Criteria

  • Distinguish between contact, execution, information access, and subsequent compromise; do not infer unconfirmed success from a single alert.

10. Investigation Playbook

  • Investigation Origin: Start from reviews of untrusted repositories, HTML previews exceeding 256KB, and Claude Desktop egress traffic.
  • Initial Checks: Verify app versions, repository origins, previewed files, and egress destinations.
  • Endpoint / Server Investigation: Preserve temporary HTML files, Electron caches, process file access, and credential file timestamps.
  • Authentication / Cloud Investigation: Investigate the usage of SSH, GitHub, npm, AWS, Kubernetes, and Claude tokens.
  • Subsequent Actions: Track repository modifications, cloud resource creations, and cluster access.
  • Containment: Update software, revoke or rotate tokens, isolate endpoints, and block malicious repositories.
  • Classification: Distinguish between previews, file reads, exfiltration, and token usage.

11. Defense and Detection Ideas

  • Single Events: Inference: Where network activity can be linked to processes, traffic from Claude Desktop to unapproved external destinations is a candidate for detection.
  • Temporal Correlation: Correlate repository clones, HTML previews, secret reads, sendBeacon requests, and cloud logins.
  • Threat Hunting: Search for coverage HTML files exceeding 256KB containing embedded scripts and blob workers.
  • Log Limitations: Inference: Ordinary network logs may not identify the sendBeacon API, and visibility into file reads depends on collection settings. Missing logs do not prove that execution did not occur.
  • Priority Actions: Prioritize upgrading to version 1.30096.1 or later, deploying secret managers, using short-lived tokens, and monitoring developer egress traffic.

12. Facts / Inference / Hypothesis

Facts

  • HTML files under 256KB were previewed using data URLs, while those over 256KB used temporary file URLs (file://).
  • The file:// paths lacked a script-src 'none' Content Security Policy (CSP), allowing local files to be fetched from the same origin.
  • Request filters failed to operate during static HTML previews, allowing JavaScript to read arbitrary local paths.
  • The proof of concept (PoC) successfully accessed SSH private keys, AWS keys, npm and GitHub tokens, as well as Kubernetes, Docker, Git, and Claude OAuth tokens.
  • navigator.sendBeacon allowed silent POST requests to the attacker's server without requiring additional approval.
  • An initial fix blocking fetch and XHR requests was bypassed using blob URL Web Workers.
  • According to Noma, the final fix was distributed in Claude Desktop 1.30096.1 and later on August 17, 2026, and Anthropic assessed the vulnerability as 8.7 under CVSS v4.0.

Inference

  • Public facts must be mapped to internal assets and logs for verification.
  • Reducing long-lived secrets on endpoints limits potential impact; monitoring egress traffic and credential access supports detection. Neither measure guarantees prevention of arbitrary file reads.

Hypothesis

No additional hypotheses. Unconfirmed matters are listed under "Uncertainties and Additional Investigation."

13. MITRE ATT&CK Mapping

ID Technique Confidence Basis
T1552.001 Unsecured Credentials: Credentials In Files high Noma reported reading local credential files in its test environment.

T1195.001 and T1041 are not assigned. Delivery through a public repository alone does not establish manipulation of software dependencies or development tools, and a one-way POST using sendBeacon alone does not establish an existing C2 channel.

14. Uncertainties and Additional Investigation

  • The presence of in-the-wild exploitation and the number of endpoints not running automatic updates remain unknown.
  • The earliest affected version, OS-specific scope, and details of the final fix cannot be established from the Noma article reviewed.
  • At the time of Noma's publication, a CVE and GitHub Advisory were pending publication.

15. Impact on SOCs and Organizations

In Noma's testing, cloning a repository containing crafted HTML and asking Claude to review that file led to credential exfiltration without additional approval. Automatic preview rendering also needs to be treated as a trust boundary. The initial fix was bypassed via Web Workers, and Noma reports that the final fix was delivered in version 1.30096.1 and later.

16. Target-Specific Summary

  • For SOC Teams: Review file access, egress traffic, and subsequent token usage related to Claude Desktop in a unified manner.
  • For Administrators: Update to version 1.30096.1 or later and remove long-lived secrets from developer endpoints.
  • For Users: Inspect HTML files and coverage reports from unknown repositories before letting Claude read them, and keep applications updated.

Top comments (0)