Critical Flaw in Claude Code Desktop Allows Malicious HTML to Capture Developer Credentials

Security researchers at Noma Labs have identified a high‑severity vulnerability in Claude Code Desktop, the AI‑powered coding assistant from Anthropic, that enables specially crafted HTML files to harvest locally stored developer credentials.

Claude Code Desktop is marketed as a locally installed companion to Anthropic's Claude large language model, offering code generation, debugging assistance, and integration with development environments. Its appeal lies in the promise of offline operation, which many developers assume provides an added layer of security.

The flaw stems from the way the application renders local HTML content. Insufficient sandboxing allows the HTML to execute scripts that can read files in the user’s profile directory, including configuration files that often contain API keys, authentication tokens, and other sensitive data used by developers in their projects.

If an attacker convinces a user to open a malicious HTML file—whether through a phishing email, a compromised repository, or a shared code snippet—the script can silently exfiltrate these credentials to an external server. The breach could give the attacker access to cloud services, private code repositories, and any downstream systems that rely on the stolen keys.

Noma Labs disclosed the issue to Anthropic after reproducing the exploit in a controlled environment. The researchers provided detailed technical documentation, and Anthropic confirmed receipt of the report. Within days, the company issued an advisory acknowledging the problem and began work on a remediation.

Anthropic released an emergency patch that tightens the HTML rendering engine, enforces stricter same‑origin policies, and isolates file system access to a dedicated sandbox. Users of Claude Code Desktop are urged to apply the update immediately and to review any stored credentials for signs of unauthorized use.

The discovery adds to a growing list of security concerns surrounding AI‑driven development tools. Similar vulnerabilities have been reported in other code‑assistant products, highlighting the tension between convenience and security when applications gain deep access to a developer’s environment.

Experts recommend that developers treat AI assistants like any other software with elevated privileges: keep them up to date, limit the scope of stored secrets, and consider using environment‑specific credential stores that can be revoked if compromised.

Going forward, Anthropic says it will conduct a comprehensive security audit of Claude Code Desktop and incorporate additional hardening measures. The incident underscores the need for ongoing scrutiny of AI‑enhanced tools as they become integral to modern software development workflows.