GoKawiilZero-click flaw found in Claude Code Desktop's preview pane, researchers say
Security researchers identified a vulnerability dubbed 'SneakPeek' in Anthropic's Claude Code Desktop application, located in its file preview feature. The flaw reportedly lets attackers silently exfiltrate sensitive developer credentials, including SSH private keys, AWS credentials, and Claude OAuth tokens, without requiring any user interaction.
GoKawiil's interpretation of the reporting above, not reported fact.
A zero-click credential theft bug in a widely used developer tool could expose cloud infrastructure and source code repositories to attackers if left unpatched, researchers suggest. Because the flaw reportedly requires no action from the victim, it may be harder for developers to detect or prevent exploitation compared to phishing-style attacks.
- The bug, called 'SneakPeek,' resides in Claude Code Desktop's preview pane feature.
- It can reportedly steal SSH keys, AWS credentials, and OAuth tokens without user interaction.
- The zero-click nature of the flaw raises concerns about silent, hard-to-detect credential theft for developers.
Yubico YubiKey 5C NFC — With credential-stealing flaws like SneakPeek targeting developer secrets and tokens, hardware-backed authentication adds a critical layer of protection beyond stored passwords and keys. A YubiKey lets you enforce phishing-resistant 2FA/U2F for your dev accounts, cloud consoles, and password managers, so even stolen credentials are far less useful to attackers. It's a simple, durable way for developers to harden their workflow against exactly this kind of silent exploit.
See Yubico YubiKey 5C NFC on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: darkreading.com, 2026-10-14
Published there as: “Anthropic 'SneakPeek' Flaw Is a Silent Zero-Click Threat”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.