Noma's SneakPeek report on Claude Code Desktop: 44 days to a final fix, and no Anthropic advisory found

44 days from report to final fix, 102 to disclosure, and a first fix Noma dates two ways

Noma says it reported SneakPeek, a flaw in the preview pane of Claude Code Desktop, to Anthropic on 4 July 2026. Its blog post and its press release, both published on 14 October, date the final fix 17 August. That is 44 days from report to final fix (derived), and 102 days from report to the write-up that made the flaw public (derived). The final fix was 59 days old when this briefing was written on 15 October (derived).

What the record does not establish is most of what a security lead would ask next. Neither Noma document says anyone exploited the flaw outside Noma's own proof of concept, and neither says nobody did. No source gives a count of exposed installs, the first affected version, whether the credentials Noma lists were read from default locations, or whether anyone but Noma found the bypass in the 24 days before the final fix. Anthropic sells the product and, per Noma, set the severity rating, and it has published nothing that this briefing could find: no GitHub security advisory, no CVE record and no line in its Desktop release notes. Noma says an advisory and a CVE are being prepared. As read between 08:08 and 08:31 BST on 15 October 2026, neither existed.

The two Noma documents also disagree with each other. The blog dates Anthropic's first fix, and Anthropic's request for a retest, 24 July, the same day Noma reports the bypass. The press release, which Dark Reading follows, dates the first fix 9 July. So the first fix lasted either 0 or 15 days before Noma bypassed it (derived), and the report-to-first-fix interval is either 20 days or 5 (derived). A post-incident review that needs one figure should say which document it used.

This briefing reads Noma's two documents in full, the Dark Reading and CSO Online reports, Anthropic's Desktop release notes and documentation, and Anthropic's published security advisories for Claude Code. It leaves out the specific trigger and the code that Noma and some of the trade press print, because a defender needs neither to act. It describes the class of flaw, a viewer that runs content from a repository with the developer's own access, and then sets out the dates, the versions and the gaps.

What Noma reports, at the level a defender needs

Claude Code Desktop is the Code tab of Anthropic's Claude Desktop app. Noma describes its preview pane as an embedded browser panel that renders the HTML files Claude reads or edits. Anthropic's own documentation says the Browser pane "can also open static HTML files, PDFs, images, and videos from your project", and that a developer clicks a path in the chat to open one. Noma says that, in the builds it tested, the pane rendered the file automatically. The record does not reconcile the two, and the documentation describes the current product, not the July builds.

Noma says the pane had three defences: a policy that blocked scripts in the rendered page, an isolated origin that stopped the page reading local files, and a request filter that blocked reads of local files. It reports three gaps that, chained, defeated all three. The script-blocking policy did not apply on one way of loading a file, the origin was not isolated on that route, and the request filter was not active when the pane showed a static file straight from disk. Dark Reading lists the same three as missing content security policy, unrestricted origin access and inactive request filtering.

The scenario Noma demonstrates starts with a developer who clones a public repository that looks ordinary and asks Claude to review a file in it. Noma says the pane then rendered the file, a script inside it ran, and the script read credentials on the developer's machine and sent them out. The credentials it lists are SSH private keys, cloud credentials, npm and GitHub tokens, Kubernetes and container-registry credentials, Git identity and Claude's own OAuth tokens. Noma says no permission request appeared, because the code ran in the renderer and not as an action by Claude's agent: in its words, "the rendering step is where the malicious code executes". That distinction is the part of the finding that travels beyond one product.

Noma Labs is the research arm of Noma Security, which sells a platform for securing AI agents, so a finding that coding tools need a security layer from someone other than the model vendor is also its sales argument. Its researcher said as much to Dark Reading, in terms that the company that supplies a model cannot also be the only security provider. That does not make the finding wrong. Anthropic's release notes and documentation confirm that the pane exists and opens HTML files, and no source records Anthropic disputing Noma's account of the bypass or the dates. It does mean that every figure in the account comes from the party that found the flaw, which also has a commercial interest in its prominence, and that none of it was reproduced for this briefing.

The clock, computed

Noma's blog and press release each give a dated timeline, and Anthropic's Desktop release notes give build dates. The table sets them side by side. Day 0 is 4 July, and every day count is derived.

Noma's SneakPeek timeline from its blog and press release (both 14 October 2026), with Anthropic's Desktop release-note date. Day counts are derived from 4 July.

Event	Dates as read	Day
Noma reports, with a proof of concept	4 July (blog, press release, Dark Reading)	0
Anthropic triages and scores it CVSS 8.7, High	9 July (blog, press release)	5
First fix	9 July (press release, Dark Reading) or 24 July (blog)	5 or 20
Retest; Noma reports a bypass of the first fix	24 July (blog, press release)	20
Anthropic confirms the bypass	3 August (blog) or 5 August (press release)	30 or 32
Desktop 1.30096.1 listed in Anthropic's release notes	13 August (Anthropic's changelog)	40
Final fix	17 August (blog, press release, Dark Reading)	44
Public write-up	14 October (Noma, Dark Reading, CSO Online)	102

The intervals that follow. Report to final fix: 44 days. Bypass reported to final fix: 24 days (24 July to 17 August), during which Noma says the first fix could be bypassed. Bypass reported to Anthropic's confirmation: 10 days on the blog's date or 12 on the press release's. Final fix to public write-up: 58 days. Report to first fix is 5 or 20 days, and first fix to bypass is 15 or 0 days, depending on which Noma document is right. All are derived.

A fourth date fits neither document. Anthropic's release notes list Desktop 1.30096.1, the version Noma gives as the first fixed build, under 13 August, four days before the 17 August on which Noma dates the fix (derived). The notes do not say what that build fixed. Noma's press release says the final patch was "verified and deployed" on 17 August. The record does not say whether 17 August is the day the build shipped, the day Noma retested it, or the day Anthropic closed the report.

Which versions are affected, which are fixed, and whether auto-update applies

Noma gives a fixed version and no affected range. Everything else in the table is Anthropic's own documentation, read on 15 October, or arithmetic on it.

Affected and fixed versions and the update path. Noma's blog for the fixed version; Anthropic's release notes, documentation and support pages for the rest. Derived figures are marked, and the Reading column is this briefing's inference.

Question	What the record gives	Reading
Fixed	Claude Desktop 1.30096.1 and later, delivered by auto-update (Noma). Anthropic's release notes list 1.30096.1 on 13 August and 1.30096.5 on 14 August.	Noma's version floor. Anthropic names no fixed version for this flaw.
Affected	Not stated: the first affected build, the platforms and the number of installs are in no source.	Every Desktop build with the pane before 1.30096.1. The release notes list 14 builds dated 4 July to 12 August (derived); Noma does not say which carried the first fix.
The command-line tool	Noma's account is of the Desktop preview renderer. Anthropic says the Code tab runs its own copy of Claude Code, separate from the claude command.	A terminal update does not show that Desktop is fixed.
Auto-update, macOS and Windows	Anthropic's Windows page says the app checks for updates about every four hours and applies them automatically. Its policy page gives a default of 72 hours before a forced restart applies a prepared update.	On documented defaults, about 76 hours from release to applied fix at worst (derived: 4 plus 72). Neither page says the two add this way.
Where auto-update does not apply	Administrators can turn it off with the disableAutoUpdates policy when a management tool owns versions. On Linux, Anthropic says the app does not update itself, and a downloaded .deb package does not opt in to updates.	Pinned fleets, downloaded Linux packages and machines that never relaunch sit outside "delivered via auto-update". Anthropic's week 27 digest says the Linux build is in beta and has the same live preview.
Time since the fix	The 1.30096.1 build is 63 days old and Noma's 17 August is 59 days old on 15 October (derived).	Both are well past the 14 days Cyber Essentials allows, below.

Two things follow. First, "fixed in 1.30096.1" is a floor reported by the finder, not a version Anthropic has said fixes the flaw, and Anthropic's release notes for that build list unrelated fixes. Second, a machine's current version cannot show when the fix reached it. A laptop that updated yesterday ran an affected build for as long as it was behind.

What Anthropic says, and where it says it

Anthropic sells Claude Code Desktop and, according to Noma, received this report and set its severity rating, so each statement it makes about the flaw is a vendor describing a flaw in its own product. This briefing treats it as it treats any vendor: what Anthropic has said is attributed to it, and what others say about it is attributed to them.

Where Anthropic would say something about SneakPeek, and what was read there on 15 October 2026.

Where Anthropic would say it	What was read	Result
GitHub security advisories, anthropics/claude-code	35 advisories through the repository's public interface; the latest published 13 October.	None names the preview pane. The Desktop advisory GHSA-v234-4jrq-mgg6 concerns a different flaw.
National Vulnerability Database keyword search	SneakPeek, Claude Desktop preview, Anthropic preview.	No SneakPeek record. A search for Claude Desktop returns 10 records, none about the preview pane; the newest, of 13 October, concerns plugin installation.
Claude Desktop release notes	65 entries, 5 June to 13 October 2026.	The word security appears once, in a fix about security-key sign-ins. No entry names a preview fix.
Claude Code weekly digests, weeks 27 to 34	Read for preview and security notes. Week 31 returned no page.	None in the weeks that exist.
The press	CSO Online asked Anthropic for comment. Dark Reading quotes no one at Anthropic.	CSO says Anthropic did not immediately respond. No on-record Anthropic statement was found.

Everything attributed to Anthropic about this flaw reaches the reader through Noma. Noma says Anthropic triaged the report, scored it CVSS 8.7 under version 4.0 of the scoring system, rated it High, and "treated the impact as equivalent to code execution on the host". Noma says Anthropic confirmed that its first fix was incomplete. Noma's researcher told CSO that Anthropic confirmed it was preparing a GitHub security advisory and had requested a CVE. Each is the finder's report of what the vendor said. None is a statement from Anthropic.

On the rating and the advisory, the record is silent or the two Noma documents conflict on four points. Anthropic's vector string is not published, so the 8.7 cannot be checked. Noma's blog adopts Anthropic's score and gives none of its own, so nothing shows whether the researchers' rating and Anthropic's differ. The press release's headline says "Critical" while its text calls the same score High. And the press release lists an advisory and a CVE as posted in October while the blog calls them "pending publish"; as read, the blog is right.

Anthropic's release notes use the word security once in 65 entries, so their silence here is not specific to this flaw. One Desktop advisory in the same repository, GHSA-v234-4jrq-mgg6, names 1.15962.0 as the fixed build. The release notes date that build 25 June, the advisory was published on 25 September, 92 days later (derived), and the notes for 1.15962.0 do not mention security either. The consequence is practical: release notes cannot be used to find security fixes in Desktop. The advisory feed is the place, and for this flaw it was empty when read.

Stated and not stated: the record, line by line

The table keeps what Noma and the press state apart from what no source states. The right-hand column is the one that matters for a decision.

Stated and not stated about SneakPeek, from Noma's blog and press release, Dark Reading, CSO Online and Anthropic's own pages, read 15 October 2026.

Question	Stated	Not stated
Was it exploited?	Noma demonstrated its own proof of concept against a repository it built.	Any exploitation by anyone else, any telemetry, or Anthropic's view. Neither Noma document reports exploitation against real users, and neither rules it out.
How many were exposed?	Fixed in Desktop 1.30096.1 and later, by auto-update (Noma).	The number of installs, the first affected build, the platforms, and how many updated before 17 August.
Which credentials?	SSH private keys, cloud credentials, npm and GitHub tokens, Kubernetes and registry credentials, Claude's OAuth tokens.	Whether the examples sat in default locations, whether keys in a hardware token or operating-system store were reachable, and whether passphrase-protected keys were tested.
Did the bypass reach users?	Noma found the bypass at a retest on 24 July and says the first fix was incomplete.	Whether anyone else found it in the 24 days before the final fix, or which builds carried the first fix.
Is it fully fixed?	Noma says Anthropic's update "fully resolves all identified attack vectors" and that Anthropic closed the report as resolved after a final retest.	Anthropic's description of the fix, the build that carried each fix, or any independent check. The vectors are those Noma identified.
Does the rating match?	CVSS 8.7, High, version 4.0, assigned by Anthropic (Noma, CSO Online).	The vector string, Anthropic's own wording, any second rating, or why the press release headline says Critical.
Is there an advisory or CVE?	Noma's blog: pending publish. Noma says Anthropic is preparing both.	An identifier, a date, an advisory text, or an affected range. None was found on 15 October.
Is it really zero-click?	A developer clones a repository and asks Claude to review a file, and Noma says no permission request appears.	Whether the pane rendered automatically in every build and session. Anthropic's documentation describes clicking a path to open an HTML file.

Six labels doing the work of controls

A friendly name is not a control. Six labels in this story each stand in for a property the record does not show. Each is a reason to read the sentence, not the word.

Labels used about SneakPeek, who used them, and what the record shows.

Label	Used by	What the record shows
Preview	Noma, and Anthropic's release notes ("preview pane"). Anthropic's documentation calls it the Browser pane.	A component that loads a file from a repository the developer did not write, runs script in it, and has the developer's file and network reach. The word describes the purpose, not the privileges.
Zero-click	Dark Reading's headline; its lead says "no prompt, no click".	Noma's blog and press release do not use the term. Noma's scenario needs a developer to clone a repository and ask Claude to review a file. No further click, but not no action.
Patched	Dark Reading: patched now. Noma's press release: the update "fully resolves all identified attack vectors".	On Noma's account the first patch was bypassed. "Fully resolves" is Noma's wording and covers the vectors Noma found. Anthropic has published no description of the fix.
Sandbox	Dark Reading: built-in sandbox protections. Noma: three defences.	Noma's researcher told CSO the protections existed but did not cover every path. A sandbox is the set of paths it covers. The NCSC says to evaluate whether an agent product's built-in sandbox is appropriate for the use case.
Desktop app	Noma, Anthropic, the trade press.	Noma notes the app's whole interface runs on a full Chromium engine with the standard web APIs. The label reads as a packaged product. On Noma's account it is also a browser engine with the developer's file access, and Noma does not discuss the command-line tool.
Critical	The headline of Noma's press release.	The same release calls the score 8.7 High. Dark Reading says high-severity.

One vendor's guide puts the preview point plainly: the proposed diff covers only the edit, and the preview renders the document around it too. That vendor, General Analysis, sells AI red-teaming, and its guide is a secondary source that did not reproduce the flaw. The point stands on Noma's description alone: an approval for an edit is not an approval for what a viewer does with the rest of the file.

The wider point: the coding agent sits where the developer's most valuable credentials sit

The list of what Noma says could be read is not a list of exotic secrets. It is what a working developer's machine holds: SSH keys that open servers and code hosts, cloud credentials, package and Git tokens, registry and cluster access, and the token that signs the developer in to the coding tool itself. On Noma's account the preview window ran with access to them all. The NCSC's guidance on development environments says what follows: an attacker who compromises a developer's environment will "inherit the same level of permissions and access as that developer".

The usual advice for coding agents is about the agent: what it may be talked into doing, which commands need approval, what its sandbox allows. SneakPeek, as Noma tells it, was none of those. The code ran in the app's own renderer, so approval prompts for agent actions did not see it, and the agent's transcript would not show it. Sysdig's senior cybersecurity strategist told CSO that agent-level logs would not necessarily capture such execution, and that file reads and outbound connections would be visible at the runtime layer. Sysdig sells runtime security, which is the layer it points to.

Other briefings on this site have met the same asset from other directions: a claim that an encrypted web page made a coding agent send a secrets file out, with no run count, and 543,699 credentials still working in public GitHub code. They differ in nearly everything except what is at risk. DevOps.com notes that it is not clear whether other desktop coding tools have the same class of flaw. Nothing read for this briefing tests that, and none of it says they do or do not.

The UK: what the NCSC, Cyber Essentials and the ICO say, as read

None of these pages was written about SneakPeek, and none mentions it. They were read on 15 October 2026 and are described only as the pages say.

UK guidance as read from the primary pages on 15 October 2026, and what follows for an engineering team. The right-hand column is this briefing's reading.

Source	What it says, as read	What follows
NCSC, Secure your development environment (version 1.0, published 2019)	A compromised developer environment gives an attacker the developer's permissions. It advises multi-factor authentication, least privilege, revoking credentials that may be compromised, not running production from a development environment, and protective monitoring.	The page predates coding agents and describes this outcome. Treat a laptop that opens other people's repositories as compromisable.
NCSC, Managing the cyber risk of agentic AI (blog, 20 August 2026, interim)	Credentials an agent can use are part of its "blast radius": API keys, OAuth grants, SSH keys and authenticated sessions. Each agent should have its own identity, only the permissions the task needs, and credentials with the shortest possible lifetime. Built-in sandboxes should be evaluated, not assumed.	SneakPeek's credential list is the NCSC's list. The blog is about agents that misbehave, not viewers that run repository content; the credential advice applies to both.
Cyber Essentials, Requirements for IT Infrastructure v3.3 (April 2026)	All software on in-scope devices must have automatic updates enabled where possible and be updated within 14 days of release where the vendor calls the fix critical or high risk, the CVSS v3 score is 7 or above, or the vendor gives no detail of the level.	For 1.30096.1, 13 August plus 14 days is 27 August, and 17 August plus 14 is 31 August (derived). Anthropic gave no detail, so the third branch applies. Commercial applications count as software in the definition.
UK GDPR Articles 32 and 33, and the ICO's guidance	Security must be appropriate to the risk. A personal data breach is a breach of security leading to unauthorised access to personal data, and the ICO must be told within 72 hours of becoming aware, where feasible, even without all the details, unless the breach is unlikely to risk people's rights and freedoms. The ICO says its security guide is under review after the Data (Use and Access) Act.	An exposed credential is not itself a breach. A breach arises if the credential was used to reach personal data, or personal data on the machine was read. The 72 hours runs from awareness, not from an advisory.

Cyber Essentials is the sharpest tool here. Its 14-day clock has three branches: a vendor that calls the fix critical or high risk, a CVSS v3 score of 7 or above, or no detail from the vendor at all. Anthropic's release notes gave no detail, so the third branch applies on the record, and on Noma's account of a High rating the first would too. The scheme names version 3 of the scoring system and the rating reported here is version 4.0, so the score branch is the one that cannot be checked. Either way, if Noma's version floor is right, an in-scope device should have had a fixed build by 27 August (derived). That is the case for automatic updates in one line: the clock starts at release, not at disclosure.

For a UK engineering team the actions that matter are the ones the NCSC names for credentials: rotate what may have been read, scope what each credential can reach, move to short-lived tokens, and give the coding agent an account of its own. The checklist below puts them in order.

What to do, in the order worth doing

Each step below follows from a figure or a statement in this briefing, and none needs the exploit to be re-run. The order puts the quick, high-value checks first and the changes to how credentials live after them.

What could not be verified

• Anthropic's side. No statement from Anthropic about SneakPeek was found. The fixed and affected builds, the description of the fix, and the advisory and CVE identifiers are not published.
• Noma's account. It was not reproduced, and this briefing tested nothing. Noma's two documents conflict on three dates and on the advisory's status.
• Time. The sources were read from 08:08 BST on Thursday 15 October 2026 and the advisory feed was last re-read at 08:31 BST. An advisory or CVE posted after that is not reflected here.
• Access. Dark Reading and DevOps.com refused a plain fetch and were read in a browser. Two other pages that carry the Noma release, TechRepublic and VMblog, returned a block page and were not read.
• Deliberate omissions. Noma and some of the trade press print the specific trigger and a code snippet for the bypass. They are not repeated here.

The question that exposes the gap

If a repository you did not write were opened in your coding agent's preview pane tomorrow, which credentials on that machine would still work a week later, and how would you know they had been read?

Key facts