CSO Online, October 14, is the incident report. Ask Anthropic’s Claude Code to review an HTML file and, in the version Noma Security tested, malicious JavaScript in that file could run in the desktop preview pane. Local files. Cloud credentials. The development environment. Noma’s name for it is SneakPeek. Anthropic assigned CVSS 8.7 High (v4.0). A CVE ID was not available when CSO published. Eli Ainhorn, Noma’s senior AI vulnerability researcher, said Anthropic was preparing a GitHub Security Advisory.
Dark Reading the same day is the zero-click version of the same chain. Public repo. HTML padded past 256KB. Embedded script. Developer asks Claude Code to review or edit. Preview renders. Credentials leave. Developers Digest, October 15, prints the fixed build: Claude Desktop 1.30096.1.
GitHub Copilot does not appear in those three write-ups. That is the comparison this week, not a claim that we audited Copilot. We already ran Cursor versus Devin Desktop on survey share. Ollama versus LM Studio is local ports. This week is an Electron preview pane versus the chat you already have in VS Code.
256KB was the policy. file:// was the hole
Noma traced the desktop preview to an Electron Chromium panel that shows HTML Claude has generated or modified. CSO’s account of the first gap is a size threshold. Files under 256KB became base64 data: URLs with a strict Content Security Policy that blocked script. Files over 256KB were written to disk and loaded as file:// URLs, which skipped that CSP.
The second gap is origin. file:// in Chromium is not an opaque sandbox origin. Noma says the renderer then had local filesystem access. Dark Reading lists the three architectural gaps as missing CSP, unrestricted origin access, and inactive request filtering. Same bug, three names.
That is not the model jailbreaking. CSO is explicit: the script ran in the preview’s rendering process, not as an action the agent took. Controls you put on the model do not automatically cover the pane. Developers who believed they were in a sandbox were looking at the wrong process.
Dark Reading’s attacker story is boring on purpose. A normal-looking public repository. An HTML file that could pass as a coverage report. Padding past 256KB so the preview took the file:// path. Ainhorn’s write-up, quoted there: clone, ask Claude to review, silent exfiltration in the background.
Developers Digest names what Noma listed as readable: SSH private keys, AWS keys, npm and GitHub tokens, Kubernetes credentials, Docker registry auth, Claude’s own OAuth tokens. Exfil via navigator.sendBeacon(). No permission prompt, because the agent never “took an action.” The renderer did.
If your threat model was “the LLM might cat ~/.aws,” you were in the right neighborhood and the wrong process.
The first patch was a filter. The worker walked around it
CSO says Anthropic’s initial fix blocked the preview pane from making direct file reads from the main page context. Ainhorn told them the bypass: move the file-reading code into a Web Worker, a background thread. Requests then came from a context the patch did not cover. Noma reported the bypass. A deeper architectural fix followed.
Developers Digest has the same sequence with more plumbing. First patch blocked fetch() and XMLHttpRequest to file:// from the main page. Noma moved fetch() into a worker created from a blob: URL. That is why their chronology puts a later build as the real close, not the first filter. They print Claude Desktop 1.30096.1 as the version to be on.
Treat their July/August internal dates as their reconstruction of the patch series, not as this week’s ship clock. This week’s news is the public reporting. The actionable number is the build they name.
Noma says Anthropic collaborated and fully resolved the issue. CSO says Anthropic did not immediately respond to a request for comment. Both can be true. You still check Help → About.
CVSS 8.7 is Anthropic’s number in CSO, v4.0. No CVE in that article. If you need a ticket ID for change management, wait for the GitHub Security Advisory Ainhorn said was coming, and match it to 1.30096.1 rather than to a blog title.
Zero-click, in Dark Reading’s headline, means no extra “allow this plugin” dialogue. The click was “review this HTML,” which is a normal agent request. If your policy trains people to paste untrusted files into an assistant, this is the demo of why the preview pane is in scope.
Copilot is the product not named in the chain
GitHub Copilot is the other seat a lot of the same developers already pay for. It is not described in the CSO, Dark Reading, or Developers Digest extracts we have for this incident. I am not going to invent a Copilot HTML file:// threshold to complete the table.
What you can say without lying: Noma’s chain is specific to Claude Code Desktop’s preview of HTML in Electron. Copilot Chat living in VS Code is a different process graph. That is not an audit. It is why Copilot wins this week’s comparison on the only axis the reporting actually measured, which is “did this bug land in the write-up.”
If your org already standardized on Copilot, this week is not a reason to switch to Claude Code Desktop until 1.30096.1 is the floor. If your org standardized on Claude Code Desktop, this week is a patch ticket, not a brand crisis, provided you actually install the build.
Do not read silence about Copilot as a guarantee about Copilot’s own preview, extensions, or agent mode. Silence is silence. The sourced object is Claude’s pane.
Cursor showed up in our last Software piece as the IDE with 14.9% survey share. It is also not in Noma’s SneakPeek chain. I am not swapping the second product to Cursor to make a prettier fight. Copilot is the incumbent chat most finance teams can already name on a PO.
Winner, for this week: GitHub Copilot, because the incident under review is on the other app. That winner tag will look silly if Copilot ships its own pane bug next month. Tags are weekly. CVEs are not.
What the pane was for, and why a coverage report was enough
Developers Digest’s demo file is a coverage report. That is the social-engineering detail that matters. Security people think in terms of obvious payloads. Developers open HTML that looks like tooling output all day. A padded report is on-genre for a coding agent.
Claude Code Desktop’s preview exists so you can see HTML the agent wrote or edited without hopping to a browser. That is a reasonable product idea. It becomes a browser with your home directory if the origin is file:// and CSP is off.
Dark Reading’s list of stealable material is the cloud-native developer laptop: AWS, GitHub, API keys, Claude OAuth. If you have those files on disk, the pane does not need the model to be “agentic.” It needs Chromium to be sloppy.
CSO’s “risk beyond the AI model” section is the sentence to take to a CISO who still thinks jailbreaks are the whole class. The model can be perfectly aligned and the preview still fetches ~/.ssh. Alignment docs do not cover Electron.
If you only use Claude Code in a terminal, ask whether you also installed the desktop app. The bug as reported is the desktop preview. Do not assume the CLI shares the pane. Do not assume it does not share other code. Patch the thing Noma named.
Untrusted repositories are the delivery system. A public GitHub project with a large HTML artifact is enough. “I only review famous orgs” is not a control. Famous orgs get extra files too.
Patch, then stop opening untrusted HTML in any agent preview
Minimum this week: Claude Desktop 1.30096.1 or newer. If you cannot see that build, treat the app as a browser pointed at your disk.
Second: do not ask any coding agent to preview HTML from a repo you just cloned until you know how that preview is origin-isolated. If the vendor cannot say data: plus CSP versus file://, you are in the 256KB story with different branding.
Third: rotate what Noma listed if you reviewed HTML in the vulnerable app. SSH keys. Cloud keys. npm and GitHub tokens. Kubernetes configs. Docker registry auth. Claude OAuth. That list is long because developer laptops are long. Rotating “the AWS key” and leaving npm is how you stay owned.
Fourth: Copilot users still rotate if they pasted the same files somewhere else. Winning a comparison does not mint a certificate.
We are not going to pretend Copilot’s computer-use previews, if any, were tested here. They were not in the three sources. The comparison is incident versus incumbent.
If you need a table for procurement: Claude Code Desktop has a public CVSS 8.7 this week and a named patch. GitHub Copilot has no row in that table. Buyers who need a row should wait for the advisory, not for a Twitter thread.
Linus using Claude Code on a kernel branch made Phoronix this week in search results. That is a different surface, CLI-shaped, and it is not this preview bug. Do not weld celebrity kernel work to SneakPeek.
Inventory is the part most teams will skip. Ask who has Claude Code Desktop installed, not who has an Anthropic API key. The bug as written is the desktop app’s preview. A laptop that never installed Desktop is outside Noma’s chain. A laptop that installed it for a demo in July and never opened it again is inside the chain until 1.30096.1 is on disk.
If you cannot get a build number out of users, you do not have a patch program. You have a Slack message. CSO’s 8.7 is high enough to justify a mandatory update. It is not high enough to show up in a browser if nobody launches the About screen.
Copilot-only shops still have homework: decide whether HTML preview is allowed from cloned repos in any tool, including Copilot Chat with a local file. The answer can be no. That answer does not require a CVE ID.
The $0 control is still “do not render strangers”
Agent IDEs sell speed. The 256KB threshold sold convenience: small files get a tight CSP, large files get a real file so Chromium does not choke on a giant data: URL. That trade is understandable. It is also how you get a security boundary that depends on file size, which attackers can pad.
A size threshold is not a sandbox, and neither is a worker or a file:// origin. Noma already wrote that, in more words.
GitHub Copilot, as the product not in the chain, is the conservative pick until Claude Desktop versions are inventory. If you like Claude Code, take the patch and keep it. The winner field on this site is not a religion. It is which side of this week’s write-up you would rather be on when the HTML is a coverage report.
Check the build. Then go back to work. The pane will still be there. It should not still be able to read the key file.