Merely asking Anthropic’s Claude Code to evaluation an HTML file might hand attackers entry to a developer’s machine, cloud credentials and software program growth atmosphere, in response to a brand new Noma Safety discovering.
Noma’s researchers discovered a vulnerability affecting Anthropic’s Claude Code Desktop app that might permit malicious JavaScript embedded in an HTML file to execute with out additional consumer interplay, doubtlessly exposing delicate host recordsdata. The flaw, known as SneakPeek, particularly affected the applying’s automated preview pane, which renders HTML recordsdata generated or modified by Claude.
“It is a sturdy instance of how rising applied sciences are reshaping the assault floor,” stated Ronald Lewis, head of cybersecurity governance at Black Duck. “Attackers are more and more focusing on the AI ecosystem, exploiting implicit belief relationships between fashions, brokers, instruments, knowledge sources, and linked companies.”
