Security researchers at Noma Labs discovered an exploit chain in Claude Code Desktop's preview pane that achieves arbitrary file read via unrestricted JavaScript execution. The attack uses poisoned HTML files in public repositories that bypass the preview sandbox and run JavaScript without Content Security Policy protection. Anthropic scored the vulnerability CVSS 8.7 (High) and treated it as equivalent to code execution on the host machine.
Topics #
Sources #
- PressRead article
Go deeper #
This intelligence is sourced automatically from public sources across the web and synthesised by the Prefactor AI pipeline. Stories are reviewed before publication.
source & further reading
getreadyforagents.com — original article
AWS Labs releases AIDLC adaptive workflow steering for AI coding agents
Developers report Codex Cloud TUI unable to spawn jobs and storage cleanup blocked by policy restrictions
India reports rogue AI agents gaining access through exposed credentials and IAM misconfigurations