Noma Security Discloses Claude Code Desktop Exploit

Noma Security today disclosed an exploit in the Claude Code Desktop application from Anthropic that silently runs arbitrary JavaScript to exfiltrate sensitive local data, including credentials, keys and tokens, via a file that runs in the preview pane.

Dubbed SneakPeek, Anthropic has already released a multi-layered security update that fully resolves the attack vectors identified in its artificial intelligence (AI) coding tool for the desktop.

Eli Ainhorn, senior AI vulnerability researcher for Noma Security, a provider of a platform for securing AI applications and agents, said researchers at Noma Labs discovered the bypass of the sandbox defenses of Claude Code Desktop after realizing that the tool provided by Anthropic was running JavaScript code.

The exploit only affected automated previews of 256KB files or larger that were converted to run on a local disk rather than being run in the Electron-based Chromium rendering panel designed to show real-time previews of HTML files. Loading as a file:// URL granted the preview renderer direct local filesystem access in Chromium, rather than isolating it. The request filter intended to block file:// access remained inactive during static file rendering to allow unrestricted reads across a local host filesystem.

A cyberattacker could use that exploit to deploy a large HTML file that included a malicious embedded script in a public code repository. When a developer asked Claude Code to review or edit the file, the preview pane rendered the document automatically, triggering silent background exfiltration of credentials and Kubernetes cluster configurations back to an attacker’s server via standard application programming interfaces (APIs) found in a browser.

It’s not clear if other AI coding tools running on the desktop are vulnerable to similar exploits, but as AI coding tools are added to software supply chains, it’s become apparent that they create a new attack vector that needs to be secured. DevSecOps teams should first take an inventory of the AI coding tools that have been added to their software supply chains before ensuring fundamental security controls are pervasively implemented, said Ainhorn.

The one thing that is certain is cybercriminals are more aggressively than ever trying to compromise software supply chains in the AI era. The challenge is that many AI tools have been added to the workflows used to build applications without being properly vetted by DevSecOps teams, noted Ainhorn. The end result is an expanded attack surface that is all too easily exploited by cybercriminals who are, among other things, poisoning files to launch a prompt injection attack.

Hopefully, DevSecOps teams will, going forward, be able to proactively secure software supply chains as organizations realize the scope of the potential risks. The issue is that for every DevSecOps engineer, there are orders of magnitude more developers that don’t generally have the greatest appreciation for best application security practices.

The challenge is that, in the meantime, it’s likely there will be many more cybersecurity incidents involving AI coding tools than most DevSecOps teams are currently prepared to handle.