Fake coverage report stole keys via Claude Code Desktop

A developer clones a public repo, opens Claude Code Desktop and asks it to look at the coverage report. That one routine question is enough to hand an attacker the machine's SSH keys, cloud credentials and Claude's own OAuth tokens, security firm Noma Labs showed in a detailed writeup.

At a glance

• The payload hides in an oversized HTML file, and Claude renders it automatically in the preview pane, so no download, no click and no permission prompt ever warns the victim.
• Files under 256KB render as data: URLs under a policy that blocks scripts, while anything larger loads through a file:// URL with no such policy, giving the script read access to the whole disk.
• Anthropic rated the flaw CVSS 8.7, patched it, watched the patch get bypassed with a Web Worker, and shipped the full fix on August 17, 2026 in Claude Desktop 1.30096.1.

If you have not used it, the preview pane renders HTML the moment Claude touches it. According to Buildgreatproducts, the pane is a tabbed browser shared between you and Claude; after editing project files Claude starts a dev server and opens it there, taking screenshots and inspecting the page. Builder.io and Buildgreatproducts add that autoVerify runs by default, so Claude reloads the preview after every edit, which is why the victim needs no further click.

One question was enough to pull every secret off the disk

Noma Labs built a repository that looked like any normal project, with source files, tests and a coverage report. These reports bundle source maps and CSS, so they run large, and a 500KB file raised no flags. Noma padded theirs past 256KB and hid a JavaScript payload inside.

The victim clones the repo and asks Claude to check which modules have coverage gaps. Claude reads the file, the preview pane renders it, and the payload runs. It works out the home directory from the temp file path and starts pulling files: SSH private keys, AWS access keys, npm and GitHub tokens, Kubernetes and Docker credentials, git identity.

Everything goes back to the attacker's server through navigator.sendBeacon(), a web API that fires a silent one-way POST. The victim's real IP address leaks too, via WebRTC. No permission request ever appears, because the victim's own question to Claude is what triggers the render.

Why a file over 256KB broke the sandbox

Anthropic wrapped the preview pane in three defenses. A Content Security Policy with script-src 'none' blocks JavaScript. Loading a page as a data: URL gives it an opaque origin, so it cannot reach for local files. And a request filter on the dev server proxy catches outbound requests from the renderer.

The problem is that all three cover only the small-file path. Think of the policy as a guard posted at the front door: files under 256KB come through that door, files above it are written to disk and loaded via file://, a side entrance the guard never watches. The policy never applies, Chromium lets file:// read other local files, and for a static report the request filter stays off. Chain the three and you get arbitrary file read.

Anthropic's first patch lasted the same day

Noma reported the flaw on July 4, 2026. Anthropic triaged it on July 9 and scored it CVSS 8.7 using CVSS v4.0, treating the impact as equivalent to code execution on the host. On July 24 it shipped a patch that blocked fetch() and XMLHttpRequest calls to file:// paths from the main page.

That same day Noma got around it. By running the fetch() inside a Web Worker spawned from a blob: URL, the request came from a context the filter did not cover, and all three original defects stayed exploitable. Anthropic confirmed the fix was incomplete on August 3 and shipped a complete one on August 17 in Claude Desktop 1.30096.1, delivered by auto-update.

Noma flags what the design got wrong: a security boundary sitting at a file size. Black Duck's Ronald Lewis told CSO Online that relying on size thresholds or client-side filters for security boundaries is inherently fragile, and that a compromised developer workstation is a direct route into corporate cloud. In our view, drawing the line at 256KB was always going to be the brittle part.

When the CVE is published

According to CSO Online, Anthropic is preparing a GitHub Security Advisory and has requested a CVE, with none available when the report was written. The fix itself already ships in Claude Desktop 1.30096.1 and later through auto-update, so what is still open is the public record rather than the patch.