'SneakPeek' flaw in Claude Code Desktop enabled silent credential theft
A bug in the preview pane of Claude Code Desktop, Anthropic's desktop coding tool, allowed attackers to quietly steal developer credentials, including SSH private keys, AWS credentials and Claude OAuth tokens, without requiring any click from the user, according to Dark Reading. The flaw, dubbed "SneakPeek," exploits the tool's file preview feature to leak sensitive data with no visible sign to the user. For a development team using AI coding tools, the case is a reminder that the productivity tools themselves can become a channel for leaking high-value credentials such as cloud infrastructure keys.
Sources
This summary was written automatically with AI from the public sources listed above and checked by an independent AI reviewer before publication. For full details, read the original source.