Researchers at Noma Security, an Israeli AI agent security company, published in Geektime a flaw in Claude Code Desktop's preview pane, which renders HTML files as live pages. According to the researchers, files over 256KB were loaded from disk without the three protection layers applied to small files, so a padded HTML file could read passwords, keys and tokens from the computer and send them to an attacker's server. Anthropic rated the flaw CVSS 8.7. According to the researchers, Anthropic's first fix was bypassed, and the flaw was finally fixed in an automatic update.
The attack requires the developer to ask Claude to look at such a file, for example from an open-source repository an attacker added it to. What to do: make sure the latest version of Claude Code Desktop is installed, and reduce long-lived secrets on the machine, such as permanent AWS keys and tokens with no expiry.