ANTHROPIC 'SNEAKPEEK' FLAW IS A SILENT ZERO-CLICK THREAT

Summary from the TLDR InfoSec newsletter

A flaw in Claude Code Desktop's preview pane let malicious HTML in a public repository run automatically when a developer asked Claude to review or edit it. Chained weaknesses bypassed sandbox protections and stole AWS, GitHub, API, SSH, and Claude OAuth credentials. Anthropic patched the issue after Noma found a bypass of the first fix. Developers should update and remove long-lived credentials from workstations.