Security researchers found that Claude Code Desktop's preview pane could be tricked into silently reading your SSH keys, AWS credentials, GitHub tokens and Kubernetes configs — no click required. Just clone a repo, ask Claude to review an HTML file, and the preview does the rest. The full fix shipped August 17 in build 1.30096.1. This free CVE check tool tells you where you stand. No signup, nothing installed.
The SneakPeek CVE is AI agents 2026 news because it hit Claude Code — the assistant AI agents 2026 developers rely on daily to write software. A flaw in the coding assistant puts both the code it writes and the machine it runs on at risk. Check your build version with the tool above and update to the patched release.
SneakPeek is an AI-tooling attack. The wild injections feed tracks every real-world AI attack with dates and sources — and the chatbot red-team test lets you try 5 adversarial prompts on your own bot.
Open Claude Desktop and check the build number (Settings / About). Build 1.30096.1 or newer, released August 17, 2026, contains the full fix. Anything older is vulnerable to the SneakPeek preview-pane flaw — update through the app's auto-update immediately.
SneakPeek, disclosed by Noma Labs on October 14, 2026, chained three flaws in Claude Code Desktop's HTML preview pane: files over 256KB were written to disk and loaded as file:// URLs (bypassing the CSP applied to smaller files), the file:// origin gave the preview renderer local filesystem access, and the request filter meant to block file access was inactive. A poisoned HTML file over 256KB — e.g. a test coverage report in a cloned repo — could silently read SSH keys, AWS credentials, GitHub tokens and Kubernetes configs and exfiltrate them, with no click required. Anthropic scored it CVSS 8.7.
No confirmed in-the-wild exploitation has been reported — the public reporting describes a resolved research disclosure, not evidence that a specific user was compromised. The risk window was July 4 to August 17, 2026 on unpatched builds. If you reviewed HTML files from cloned repos on an old build during that window, rotate the secrets that lived on that machine as a precaution.
A CVE checker is a free tool that tells you whether your software is affected by a published CVE — a publicly known cybersecurity vulnerability. It compares your version or configuration against the official advisory and gives you a patched, vulnerable, or unknown verdict in about 30 seconds.
Find your exact version number, then compare it against the vendor's security advisory or the NVD entry for the CVE. The fastest way is a CVE checker built for that product: paste your version and get an instant verdict against the published version tables.
You are affected when you run a vulnerable version and the vulnerable component is reachable or enabled — for example, open sign-ups, an exposed management port, or a vulnerable app installed. A CVE checker gives you the version verdict in seconds; the advisory's conditions tell you whether that verdict means real exposure.
Agent access policy check · PHP RCE exposure check · AI-discovered bugs fire drill
Ingenious AI publishes 21 live security platforms, and 100% of them run on permanent getingeniousai.com domains.