Researchers have disclosed a vulnerability in Anthropic's Claude Code Desktop that they call 'SneakPeek.' The bug resides in the application's preview pane, which processes content in a way that can be abused by attackers. Because the exploit requires no user interaction, it qualifies as a zero-click threat, meaning a developer could be compromised simply by having the vulnerable component render malicious content.
The impact is particularly severe for developers, who often store highly sensitive credentials on their machines. According to the report, an attacker exploiting this flaw could quietly steal SSH private keys, AWS credentials, and Claude OAuth tokens. These credentials would allow unauthorized access to code repositories, cloud infrastructure, and the developer's Claude account, potentially leading to supply-chain attacks or data breaches.
Anthropic has not yet issued a public statement in the source, and it remains unclear whether a patch is available. Developers using Claude Code Desktop should treat the preview pane as an attack surface and monitor Anthropic's security advisories for updates. Until a fix is confirmed, limiting the use of preview features and isolating development environments may reduce exposure.