Above 256 kilobytes, the preview pane read the disk

The preview pane in Claude Code Desktop renders any HTML file that Claude reads or edits, and it renders the file automatically. Small files, those under 256 kilobytes, load as data: URLs under a strict policy that blocks scripts. Files above that size take a different path, because the app writes them to disk and loads them as file: URLs. The size decides which path a file takes.

The second path dropped the protection. A file: URL never received the script-blocking policy, ran with same-origin access to the local filesystem, and sat outside the request filter that only works when the pane proxies a dev server. A padded file could then read SSH private keys, AWS access keys and secrets, Kubernetes cluster credentials, and Claude's own OAuth tokens, and post them out through navigator.sendBeacon without any permission prompt.

Noma Security reported the flaw to Anthropic on 4 July 2026, and Anthropic triaged it five days later. The first patch shipped on 24 July. It did not hold. Noma bypassed it the same day with a blob: URL running in a Web Worker, and the complete fix arrived on 17 August, in Claude Desktop version 1.30096.1.

By the disclosure on 14 October the flaw was resolved and rated CVSS 8.7, High. Noma's own timeline still lists the CVE ID as pending publish. No number is public yet. The write-up and its press release both come from Noma, and Anthropic's own advisory had not appeared at publication.

The preview pane exists to show the user what Claude is working on. Here it rendered a file from an untrusted repository with more access than the file deserved. The size cutoff read like a performance limit. It became the line between a guarded view and an open one.

Log take: the preview pane did the damage. The harness handed the renderer local file access, and the model never chose to use it; confidence is moderate, since the research is vendor-published, no exploitation has been reported, and Anthropic has not yet issued an advisory.