Anthropic 'SneakPeek' Zero-Click Flaw in Claude Code Desktop: Detecting and Remediating Silent Credential Theft

---
title: Claude Code Desktop Process Accessing Credential Files
id: 3f8a2c14-7b9d-4e51-a6c2-9d1e4f7a8b3c
status: experimental
description: Detects the Claude Code Desktop process (claude/claude-code) reading SSH private keys, AWS credential files, or OAuth token caches. Consistent with 'SneakPeek' preview-pane credential theft behavior.
references:
  - https://www.darkreading.com/threat-intelligence/new-anthropic-sneakpeek-silent-zero-click-threat
  - https://attack.mitre.org/techniques/T1552/001/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.credential_access
  - attack.t1552.001
logsource:
  category: file_event
  product: windows
detection:
  selection_source:
    Image|contains:
      - '\Claude'
      - '\claude-code'
  selection_target:
    TargetFilename|contains:
      - '\.ssh\id_rsa'
      - '\.ssh\id_ed25519'
      - '\.ssh\id_ecdsa'
      - '\.aws\credentials'
      - '\.aws\config'
      - 'claude\oauth'
      - 'claude\.credentials'
  condition: selection_source and selection_target
falsepositives:
  - Rare; Claude Code Desktop has no legitimate reason to read raw private key or AWS credential files outside an explicit user-initiated action
level: high
---
title: Claude Code Desktop Spawning Shell or Script Interpreter
id: 8c4e1a72-2d6f-4b38-91e5-5a3c7b9d2e41
status: experimental
description: Detects the Claude Code Desktop application spawning command shells or script interpreters with network or credential-access commands. May indicate malicious rendered content executing in the application context via the SneakPeek preview-pane flaw.
references:
  - https://www.darkreading.com/threat-intelligence/new-anthropic-sneakpeek-silent-zero-click-threat
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059
  - attack.credential_access
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|contains:
      - '\Claude'
      - '\claude-code'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\curl.exe'
      - '\wget.exe'
  selection_flags:
    CommandLine|contains:
      - '.ssh'
      - '.aws'
      - 'credentials'
      - 'id_rsa'
      - 'invoke-webrequest'
      - 'curl '
      - 'http://'
      - 'https://'
  condition: selection_parent and selection_child and selection_flags
falsepositives:
  - Developer-initiated shell tool calls through Claude Code where the user explicitly approves command execution; tune for approved-session markers if your deployment logs them
level: high
---
title: Claude Code Desktop Network Connection to Non-Anthropic Infrastructure
id: 5b2d9f63-1a4c-4e87-b3d6-7f2a8c5e9d14
status: experimental
description: Detects Claude Code Desktop establishing outbound connections to domains outside known Anthropic/API endpoints. Exfiltration of stolen SSH keys, AWS credentials, or OAuth tokens via the SneakPeek flaw must traverse attacker-controlled infrastructure.
references:
  - https://www.darkreading.com/threat-intelligence/new-anthropic-sneakpeek-silent-zero-click-threat
  - https://attack.mitre.org/techniques/T1041/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.exfiltration
  - attack.t1041
logsource:
  category: network_connection
  product: windows
detection:
  selection_process:
    Image|contains:
      - '\Claude'
      - '\claude-code'
  filter_known:
    DestinationHostname|contains:
      - 'anthropic.com'
      - 'claude.ai'
      - 'api.anthropic.com'
      - 'github.com'
      - 'githubusercontent.com'
      - 'registry.npmjs.org'
      - 'pypi.org'
  condition: selection_process and not filter_known
falsepositives:
  - MCP server integrations and user-configured tool endpoints; maintain an allowlist of approved MCP/tool destinations per team and alert on deviations
level: medium

// Hunt: Claude Code Desktop accessing credential stores or making anomalous network connections
// Covers SneakPeek preview-pane credential theft behaviors

// Part 1: Claude process accessing SSH/AWS/OAuth credential files
DeviceFileEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFolderPath has_any ("Claude", "claude-code")
   or InitiatingProcessFileName =~ "Claude.exe"
| where FolderPath has_any (".ssh\\id_", ".aws\\credentials", ".aws\\config", "oauth", ".credentials")
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName,
          InitiatingProcessCommandLine, FolderPath, ActionType, SHA256
| sort by TimeGenerated desc
;

// Part 2: Claude Desktop spawning shells/network tools with credential or web strings
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFolderPath has_any ("Claude", "claude-code")
   or InitiatingProcessFileName =~ "Claude.exe"
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "curl.exe", "wget.exe")
| where ProcessCommandLine has_any (".ssh", ".aws", "credentials", "id_rsa",
       "invoke-webrequest", "http://", "https://", "curl")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine,
          InitiatingProcessCommandLine, ReportId
| sort by TimeGenerated desc
;

// Part 3: Outbound connections from Claude to non-allowlisted destinations
let AllowedDests = dynamic(["anthropic.com", "claude.ai", "github.com",
    "githubusercontent.com", "registry.npmjs.org", "pypi.org"]);
DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFolderPath has_any ("Claude", "claude-code")
   or InitiatingProcessFileName =~ "Claude.exe"
| where isnotempty(RemoteUrl)
| where not(RemoteUrl has_any (AllowedDests))
| summarize ConnectionCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)
  by DeviceName, AccountName, RemoteUrl, RemoteIP, RemotePort, InitiatingProcessCommandLine
| sort by ConnectionCount desc

-- Artifact: Hunt.ClaudeCode.SneakPeekExposure
-- Identifies Claude Code Desktop processes, their child processes,
-- and outbound connections to aid SneakPeek credential-theft hunting

-- Part 1: Running Claude processes and their command lines
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)claude'
   OR Exe =~ '(?i)claude'

-- Part 2: Child processes spawned by Claude (potential payload execution)
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Ppid IN (
    SELECT Pid FROM pslist() WHERE Name =~ '(?i)claude'
)
AND Name =~ '(?i)(cmd|powershell|pwsh|curl|wget|sh|bash|zsh)'

-- Part 3: Network connections held by Claude processes
SELECT Pid, Name, Family, Type, Status,
       Laddr.IP AS LocalIP, Laddr.Port AS LocalPort,
       Raddr.IP AS RemoteIP, Raddr.Port AS RemotePort
FROM netstat()
WHERE Name =~ '(?i)claude'
  AND Status =~ 'ESTABLISHED'

-- Part 4: Recent access/modification timestamps on credential files (Linux/macOS endpoints)
SELECT FullPath, Size, Mtime, Atime
FROM glob(globs=[
    '/home/*/.ssh/id_*',
    '/home/*/.aws/credentials',
    '/home/*/.aws/config',
    '/root/.ssh/id_*',
    '/Users/*/.ssh/id_*',
    '/Users/*/.aws/credentials'
])
ORDER BY Atime DESC

# Requires: Run as Administrator for full visibility
# Security Arsenal - SneakPeek exposure check for Claude Code Desktop

$ErrorActionPreference = 'SilentlyContinue'
$report = [System.Collections.Generic.List[object]]::new()

# --- 1. Locate and version-check Claude Code Desktop ---
$claudePaths = @(
    "$env:LOCALAPPDATA\Programs\Claude",
    "$env:LOCALAPPDATA\AnthropicClaude",
    "$env:ProgramFiles\Claude"
)
$claudeExe = foreach ($p in $claudePaths) {
    if (Test-Path $p) { Get-ChildItem $p -Recurse -Filter "*.exe" |
        Where-Object { $_.Name -match 'claude' } }
}

if ($claudeExe) {
    foreach ($exe in $claudeExe) {
        $ver = $exe.VersionInfo.ProductVersion
        $report.Add([pscustomobject]@{
            Check = 'Install'; Path = $exe.FullName; Version = $ver
            Status = 'REVIEW - confirm against latest Anthropic release'
        })
    }
} else {
    $report.Add([pscustomobject]@{ Check='Install'; Path='N/A'; Version='N/A'; Status='Claude Desktop not found' })
}

# --- 2. Detect Claude processes with unexpected child processes ---
$claudeProcs = Get-Process | Where-Object { $_.Name -match 'claude' }
foreach ($proc in $claudeProcs) {
    $children = Get-CimInstance Win32_Process |
        Where-Object { $_.ParentProcessId -eq $proc.Id -and
                       $_.Name -match 'cmd|powershell|pwsh|curl|wget' }
    foreach ($c in $children) {
        $report.Add([pscustomobject]@{
            Check='ChildProcess'; Path=$c.ExecutablePath; Version=''
            Status="ALERT: $($c.Name) spawned by Claude (PID $($proc.Id)) - CmdLine: $($c.CommandLine)"
        })
    }
}

# --- 3. Outbound connections from Claude to non-Anthropic IPs ---
foreach ($proc in $claudeProcs) {
    $conns = Get-NetTCPConnection -OwningProcess $proc.Id -State Established
    foreach ($conn in $conns) {
        $dns = (Resolve-DnsName $conn.RemoteAddress -ErrorAction SilentlyContinue |
                Select-Object -First 1).NameHost
        if ($dns -and $dns -notmatch 'anthropic|claude\.ai|github|npmjs|pypi') {
            $report.Add([pscustomobject]@{
                Check='Network'; Path=$conn.RemoteAddress; Version=$conn.RemotePort
                Status="ALERT: non-standard destination ($dns)"
            })
        }
    }
}

# --- 4. Recent access to credential files (possible staging) ---
$credTargets = @("$env:USERPROFILE\.ssh", "$env:USERPROFILE\.aws")
foreach ($t in $credTargets) {
    if (Test-Path $t) {
        Get-ChildItem $t -Recurse | Where-Object {
            $_.LastAccessTime -gt (Get-Date).AddDays(-3)
        } | ForEach-Object {
            $report.Add([pscustomobject]@{
                Check='CredAccess'; Path=$_.FullName; Version=''
                Status="Accessed $($_.LastAccessTime) - correlate with process logs"
            })
        }
    }
}

$report | Format-Table -AutoSize
$report | Export-Csv "$env:TEMP\sneakpeek_check_$(Get-Date -Format yyyyMMdd_HHmmss).csv" -NoTypeInformation

#!/usr/bin/env bash
# Security Arsenal - SneakPeek exposure audit (macOS/Linux)

MIN_VERSION="REPLACE_WITH_CURRENT_VENDOR_RELEASE"  # set from Anthropic release notes

echo "=== Claude Code Desktop version ==="
if command -v claude >/dev/null 2>&1; then
  claude --version
else
  echo "claude binary not in PATH; check app bundle"
fi

echo -e "\n=== Claude processes and children ==="
pgrep -af -i claude
for pid in $(pgrep -i claude); do
  pgrep -P "$pid" -l | grep -Ei 'sh|bash|zsh|curl|wget|python' && \
    echo "ALERT: shell/network child under Claude PID $pid"
done

echo -e "\n=== Established connections from Claude ==="
lsof -nP -iTCP -sTCP:ESTABLISHED 2>/dev/null | grep -i claude

echo -e "\n=== Credential files accessed in last 72h ==="
find ~/.ssh ~/.aws -type f -atime -3 2>/dev/null -exec ls -la {} \;

echo -e "\n=== OAuth/token caches ==="
ls -la ~/.claude* ~/.config/claude* 2>/dev/null