Noma Labs (Eli Ainhorn) disclosed an exploit chain in Claude Code Desktop's HTML preview pane. Files over 256KB loaded as file:// without the CSP applied to smaller data: previews, and the request filter did not engage for static renders, so embedded JavaScript could fetch() local paths (SSH keys, AWS creds, OAuth tokens) and exfiltrate via navigator.sendBeacon. Delivery: clone a public repo, ask Claude to "review" a padded coverage-report HTML; the preview renders automatically. Anthropic scored CVSS 8.7, shipped an initial filter, then closed a blob:/Web Worker bypass; fixed in Claude Desktop 1.30096.1+ (Aug 17) via auto-update. Classic harness risk: the agent renders untrusted UI on the developer's machine.