Elastic says infostealer operators logged in an average of eight minutes after infection, and in two cases worked through Claude Code and the ChatGPT desktop app on victims' machines
Per Help Net Security's account of Elastic Security's research, attackers across 27 confirmed cases logged in an average of eight minutes after infection, with ClickFix-style lures as the entry point in 12 cases and remote-management tools abused in 23. In one case an attacker used Claude Code through its VS Code extension on Windows to prepare tools and reach an outside server over a concealed connection; in another, commands run through the ChatGPT macOS app read an internal infrastructure document and the saved password store. Help Net notes this was misuse after the attacker already had access, not a vulnerability in either app. Elastic's own report did not open to this run.
A trojanized build of the Claude Code extension planted an attacker SSH key on developer machines for about 11 hours
StepSecurity says version 2.1.313 of the Claude Code extension was published to Open VSX carrying a malicious loader that "planted an attacker SSH key, installed per-OS persistence, opened a reverse SSH tunnel" between 09:27 and 20:35 UTC on October 29, and that Cursor, whose marketplace mirrored it, reports at most 5,000 of its users received it. The malicious version was not developed or released by Anthropic, and how it reached the registry has not been publicly established.
Dream says a suspected China-nexus actor chained the PHP2Shell flaws with a kernel bug to root 25 PAN-OS firewall and management servers, with Claude Code in its attack infrastructure
Dream says an attacker used "a custom, non-public build" of the PHP2Shell exploit chain (CVE-2026-109618 and CVE-2026-109619), paired with the Fragnesia kernel privilege escalation (CVE-2026-46300), to root 25 PAN-OS firewall and management servers in the US, Japan, Taiwan and South Korea. In a US government-affiliated environment, the attacker zeroed in on three servers: two firewalls and an internal firewall management server reached through a reverse SSH tunnel. Dream found Claude Code installed on the attack infrastructure and an AI offensive platform, aiscan, configured with DeepSeek and Kimi models. It says the code's structure and style across about 40 scripts "suggest AI-assisted development" but that it has no direct evidence that AI tools wrote the exploit or scripts.
An instruction file sitting in a Downloads folder told a coding agent to install a malicious npm package, Forever Security says
BleepingComputer reports that Forever Security found the tactic on a customer's computer, where a coding agent running with the ~/Downloads folder as its working directory tried to install a malicious npm package called "function-color" because an AGENTS.md file there told it to; the researchers could not determine how that file reached the machine, and said a malicious page could drop such a file "without any user interaction" - BleepingComputer verified their proof-of-concept page, which downloaded an AGENTS.md containing harmless text. In controlled tests the researchers reconstructed the chain against OpenAI Codex using a payload that opened the calculator app, at a reported 90% success rate, and a malicious CLAUDE.md redirected Claude Code's API traffic to a server they controlled, exposing the agent's OAuth token and letting that server return tool calls that executed code in roughly 50% of tests. Forever's Gal Weizman says internal statistics show hundreds of customers run agents from ~/Downloads, that Claude Code alone launched more than 1,300 sessions from there, and that "there is nothing here for OpenAI or Anthropic to patch."
LiteLLM says attackers used three engineers' GitHub credentials to ship a credential stealer as version 1.107.0
LiteLLM says malicious actions were taken through three engineers' GitHub accounts to force-push and publish version 1.107.0 to PyPI, Docker Hub and GHCR on October 21, and that all tokens involved in the attack have been revoked. Wiz reports the package took about 49,000 downloads per ClickPy data, was uploaded to PyPI at 11:39 UTC and quarantined at 13:20, and that stolen AWS instance role credentials were tested from two addresses about four and a half hours after exfiltration using sts:GetCallerIdentity followed by Bedrock model-listing calls, a pattern Wiz calls consistent with LLMjacking. LiteLLM says it suspects the attacker obtained GitHub CLI OAuth tokens from the logs of an internet-exposed internal deployment, noting that "Claude Code will embed a user's GitHub CLI OAuth token into a response body", and has not confirmed how that deployment was reached.
Zscaler puts a figure on the ARTEX campaign against Korean financial firms: personal data on about 67,000 people
Zscaler ThreatLabz attributes, with moderate confidence, a campaign against peripheral web applications of multiple South Korean financial firms to a financially motivated, Chinese-speaking actor using ARTEX, "an open source agentic penetration testing framework developed in China," configured with DeepSeek v4.1-flash and supplemented by GLM-5.3 and Grok 4.6. It says the actor exfiltrated data on about 67,000 people and used Claude Code sessions to plan monetisation, and that after the developer made the project closed source, "previously downloaded copies and forks may remain available."
Researchers chained three gaps in Claude Code Desktop's preview pane into zero-click theft of a developer's credentials
Noma Labs' October 14 release names SneakPeek, an exploit chain in Claude Code Desktop that it says Anthropic rated CVSS 8.7 (High). Per the release, files under 256KB were converted to base64 data: URLs under a strict script-blocking content security policy while larger files were written to disk and loaded over file://, bypassing that policy; the renderer was given local filesystem access rather than an isolated opaque origin; and the filter meant to block file:// access did not apply during static file rendering. An HTML file padded past 256KB in a public repository, rendered automatically by the preview pane when a developer asks Claude Code to review or edit it, could read API keys, cloud credentials, SSH private keys, Kubernetes cluster configurations and OAuth session tokens from the host and send them out through navigator.sendBeacon. The stated timeline: reported July 4, triaged and scored by Anthropic with a renderer mitigation on July 9, a bypass demonstrated on July 24 using blob: URL Web Workers, confirmed August 5, and a final architectural patch verified and deployed August 17. Its timeline lists “October 2026: Advisory and CVE posted”, but the release names no CVE identifier and no fixed version; Noma's own research page could not be opened here, and no Anthropic statement on it opened to this run.
A Russian-speaking access broker ran a 51-agent Claude Code cluster and took more than 628,000 records on Ukrainians, SOCRadar reports
SOCRadar's CyberXero report, as read by The Hacker News on October 12, describes a financially motivated Russian-speaking initial access broker active since at least July 2026 and still running, which took more than 628,000 records tied to Ukrainian individuals from four Ukrainian organisations. Per that account the actor ran Claude Code as a cluster of 51 specialised agents on its primary workstation for scanning, exploit chaining, reconnaissance and post-exploitation, accessed 429 WordPress administration panels out of 4,708 targets scanned, and in a single automated run deployed 32 web shells inside a 61-second window; separately it connected the open-source PentAGI tool to Cobalt Strike through an AI provider API for payload generation and pentest execution. After refusals the operator reopened fresh sessions with authorisation framing preloaded. Compromises in Poland, China and the Netherlands are also described, two Chinese entities through exposed Redis servers. SOCRadar's own page could not be opened by this run, so its publication date is not established here, and the account read says nothing about how Anthropic responded.
A compromised npm SDK harvests Claude, Cursor and MCP configuration files, then republishes itself under the victim's own publishing identity
Researchers reported that version 0.5.144 of the npm package tensorlake — described by The Hacker News as “a TypeScript software development kit (SDK) for Tensorlake applications, sandboxes, and cloud services” — was published with what Socket describes as “obfuscated malware that harvests credentials, exfiltrates secrets, establishes persistence.” The chain runs from a preinstall hook to package/lib/setup.mjs, an obfuscated loader, and a main payload at package/lib/Math_Symbol.js executed under the Bun runtime. What it takes includes npm and GitHub tokens, AWS credentials, HashiCorp Vault and Kubernetes credentials, SSH keys, .env files, cryptocurrency wallets and messaging-app data, and — the part specific to this target — the configuration and MCP files for Claude, Cursor, Kiro, Windsurf and Zed; it also drops the HackBrowserData binary. Exfiltration goes first to an endpoint at iseekaigogo[.]com, and on failure the malware reads an Ethereum contract to find a command-and-control address, with GitHub as a further fallback where encrypted data is staged in a public repository. A PowerShell “hostage token” monitor polls the GitHub API with the stolen token and, if the token is revoked, runs an attacker-supplied handler that wipes the home directory. It spreads on its own: Socket says “the worm enumerates packages associated with the victim's publishing identity,” builds Sigstore provenance and republishes compromised versions, and StepSecurity reports that it “writes .claude/settings.json and .vscode/tasks.json files into repos it can reach” so that it runs again when the project is next opened in Claude Code or VS Code. On timing, the first rogue commit to the main branch of tensorlakeai/tensorlake was made at 01:20 UTC on October 7, 2026 under a maintainer's name, and the release workflow published 0.5.144 to npm about a day later; the version has since been removed from the registry. The activity is attributed to the ChainDrop / Shai-Hulud campaign, first documented in early August 2026, which compromised hundreds of npm packages including Keyv and Cacheable. No download count for the malicious version was published.
Anthropic's cheapest new model completes 3.3% of multi-stage cyber operations where its Opus sibling completes 67.6%, and the system card says it crosses neither threshold
The Claude Haiku 5.5 system card, dated October 7, puts the model far below the rest of its generation on offensive cyber work. On CyScenarioBench, which runs multi-stage operations, Haiku 5.5 completed 3.3% of challenges against 46.1% for Claude Sonnet 5.5 and 67.6% for Claude Opus 5.5. On a binary exploitation benchmark it produced 3 control-flow hijacks, against 50 for Sonnet 5.5, 81 for Claude Mythos 5.1 and 106 for Opus 5.5, with Claude Haiku 4.5 at 0. On ExploitBench, 41 V8 environments at five trials each, it averaged 5.15 flags plain and 6.56 with AutoNudge, and “achieved full arbitrary code execution 1.0% of the time (4/410)”. The card states that the model does not cross the CB-2 or Autonomy-2 thresholds in Anthropic’s responsible scaling policy but is treated as meeting CB-1 and Autonomy-1, with the corresponding mitigations applied. On prompt injection it is the most resistant Haiku yet and still the weakest of its generation: Gray Swan IPI at k=15 gives 7.1% against 3.4% for Sonnet 5.5 and 1.0% for Opus 5.5, with coding at 0.2%, tool use at 4.0% and most of what remains concentrated in graphical computer use at 24.4%; browser use in Claude Cowork auto mode recorded 0 of 110 scenarios broken. Refusals moved a long way: 84.3% of malicious Claude Code requests refused against 66.6% for Haiku 4.5, and 82.59% of malicious computer-use requests against 58.93%.
CrowdStrike says the operator behind the South Korean bank intrusions ran ARTEX on DeepSeek and worked through Claude Code
CrowdStrike Intelligence, in a report published October 7 under Ashley Campion's name, describes “a recently released open-source agentic penetration testing (pentesting) tool developed in China” — ARTEX — used against South Korean financial organisations from late September to early October in a campaign that “resulted in exfiltrated data.” The instance examined “used DeepSeek v4.1-flash as the primary LLM backend,” likely reached through the API proxy or reseller xcai[.]pro, and the actor “supplemented this LLM with GLM-5.3 (Zhipu AI) and Grok 4.6 for additional Claude Code sessions.” Open directories on 38.244.50[.]120 and on a Hong Kong IP held “Claude Code session histories, ARTEX configuration files, and Claude memory files,” including a Chinese-language pentesting prompt; in one session the actor asked Claude where stolen Korean breach data is typically sold and for help finding Korean Telegram data-sales groups, and in another asked it to write a security-researcher résumé whose personal details, including a Guangdong location, CrowdStrike says “likely belong” to the ARTEX operator while “currently available information cannot definitively associate these details with the threat actor.” The actor is “likely a Chinese speaker and financially motivated” — “This assessment is made with moderate confidence” — and is tied to no named adversary. CrowdStrike names no victim and says the number of affected organisations is unconfirmed, citing industry reporting for a breached loan-progress inquiry service used by financial brokers at one bank and an employee mobile work-support system at another.
A plugin's pinned commit can be swapped for attacker code in four AI coding agents
AIR Security reports that Claude Code, Codex, GitHub Copilot and Gemini CLI each check out a plugin's pinned commit without confirming the checkout landed there — “That one missing check is the whole bug” — so an attacker controlling a plugin repository can substitute code that background auto-updates then install without user interaction. Anthropic fixed it in Claude Code 2.1.179 and OpenAI in Codex 0.146.0; Microsoft has shipped no fix for GitHub Copilot and Google deprecated Gemini CLI rather than patch it. The research was found in May 2026, disclosed to the four vendors in June, and carries no CVE identifier.
A study of twelve agent harnesses finds attacker text being promoted into a higher-privileged message role
A preprint presents what its authors call “the first systematic analysis of context assembly designs in real-world AI agent harnesses,” naming two classes of flaw: MessageRole Context Privilege Escalation, in which “attacker-controlled content originating from a low-privileged context is incorporated into a higher-privileged message role,” and Cross-Scope Context Privilege Escalation, which “occurs when attacker-controlled content persists beyond the context in which it was introduced.” The paper reports testing “12 real-world agent harnesses, including Claude Code and Codex,” with consequences it lists as “full agent compromise, remote code execution, denial of service, and manipulated tool or skill invocations.”
A repository's own git config makes seven AI coding agents run attacker code before any prompt
Manifold Security reports eight findings across seven AI coding agents in which a repository's git configuration names a command that git then executes on the host, with the user's privileges, before any trust prompt, because agents run git commands at session start to gather context. The named vector is the core.fsmonitor setting; Claude Code, Goose, OpenAI Codex and Cursor shipped fixes while Qwen Code, Grok Build, Hermes Agent and a second Claude Code path were unpatched at publication. The write-up states two CVEs, CVE-2026-72718 for Goose and CVE-2026-71963 for Hermes, and says delivery requires the repository to arrive as files with its .git directory intact rather than through a clone.
Anthropic ships Fable 5.1 generally and keeps Mythos 5.1 behind trusted-access vetting
Anthropic says Mythos 5.1 “demonstrates the strongest cyber capabilities of any model we've released” and is available only through its trusted access programs, while Fable 5.1 is generally available. It says Claude Code users can expect “an average of around 60% fewer interventions per session from our cyber safeguards” relative to the previous safeguards on Fable 5, with dual-use tasks including penetration testing, exploit generation and binary-based vulnerability scanning still routed to Opus models.
Researcher reaches code execution in Claude Code's Auto Mode by shadowing a Python module
Johann Rehberger redirected Claude from its WebFetch tool to curl using an HTTP 415 response, served a ZIP archive containing a malicious struct.py, and obtained remote code execution when Claude's own decoder imported a module that in turn imported the shadowed one — reporting a 60 to 80 percent success rate across payload variants on small samples. Anthropic closed the report as “Informative,” saying Auto Mode is a convenience feature backed by a best-effort classifier rather than a security guarantee; Rehberger notes his chain was not among the 72 scenarios behind a previously cited near-zero prompt-injection figure.
Rapid7 finds a crypto-fraud crew used Claude Code to build and run a vishing pipeline against wallet users
Rapid7 Labs, analysing an exposed web directory and recovered session logs from a cryptocurrency fraud operation it named ASTERIX, found the operators used Anthropic's Claude Code to manage target lead lists and configure network infrastructure — cleaning a dataset of more than 103,000 Polish phone numbers and setting up scripts to validate numbers against Crypto.com and Kraken accounts — as part of a pipeline of phishing, vishing and fake wallet apps built to steal recovery phrases. The exposed server held roughly 885,000 phone numbers across 54 countries. When the operator asked Claude to help obfuscate a malicious build, Claude declined, and the operator switched to Moonshot's Kimi model with a jailbreak prompt.
Poisoned observability logs drive AI coding agents, with a sandbox escape patched before disclosure
Tenet Security reports that error and observability data from services such as Sentry, Cloudflare and Datadog can act as an indirect prompt-injection channel into AI coding agents, claiming a 90% success rate against Claude Code running Sonnet 4.6 in Cloudflare's recommended setup, and estimating more than 15,000 organisations exposed by extrapolating from 73 public artifacts across 48 organisations. Anthropic confirmed and fixed a Claude Desktop sandbox escape used in the chain before publication, with no CVE assigned; Sentry, Datadog and Cloudflare were notified between June 3 and July 13.
Cisco Talos analyses prompt logs recovered from threat actors' own machines
Talos examined a corpus of prompt logs left by Claude Code, CodeX, Cursor and Gemini on threat actor endpoints, grouping the use into AI as a malicious software engineer, AI for scaling criminal operations and AI for vulnerability research. It reports it “did not encounter any sophisticated encoding or techniques designed to trick the models” — claims of equipment ownership, capture-the-flag or bug-bounty framing, splitting risky actions across sessions and neutral verb choice were enough — and concludes “guardrails are not functioning as expected.”
npm worm in keyv and cacheable namespaces steals AI coding-tool credentials and persists via Claude Code and VS Code hooks
A self-propagating npm supply-chain compromise spread from the keyv and cacheable namespaces into over 400 packages, using a preinstall script to harvest cloud credentials, CI/CD secrets, private keys and cryptocurrency wallets, and republishing poisoned versions through npm OIDC trusted publishing. The payload specifically targets Claude, OpenAI, Codex, Cursor and Gemini credential stores and plants autostart hooks in .claude/settings.json and .vscode/tasks.json so that the payload runs when a developer or an AI coding agent opens the cloned repository, with no npm install required.
Black Hat USA 2026 vendor announcements centre on AI agent runtime protection, discovery and least-privilege enforcement
SecurityWeek's three-part roundup of Black Hat USA 2026 announcements documents a concentrated wave of defensive products aimed at securing AI agents, including Cyera Agent Guardian and Menlo Security MARS for prompt-injection and exfiltration protection, KnowBe4 Agent Risk Manager and Mimecast Agent Risk Center for agent discovery and behaviour monitoring, Varonis intent-based access control and Zero Networks least-agency enforcement for constraining agent permissions, and Acalvio Deception Guardrails for honeytokens targeting agentic environments. Legit Security's VibeGuard 2.0 and Sysdig Secure AI specifically target AI coding agents such as Claude Code, Cursor and GitHub Copilot.
Hunt.io reports suspected China-linked operators running Claude Code and DeepSeek as an intrusion toolchain against government targets in four countries
Hunt.io analysed an exposed open directory containing 2,431 files, including operator logs of LLM sessions, and described a split-model workflow in which Claude Code acted as the execution engine for agentic tool use, bash execution and session persistence while DeepSeek-v4-pro handled attack logic, script generation and decision-making. Hunt.io reported exploitation against an Afghan government application, a Thai government administrative system via SQL injection, and two Taiwanese critical-infrastructure organisations, with reconnaissance against US government entities and financial firms in Europe, Australia and Asia.
Agent skill metadata fields can suppress permission prompts and hide a skill from the user
HiddenLayer reports that a Claude Code skill's allowed-tools frontmatter field bypasses permission requests for tools including Bash, that setting user-invocable to false keeps a skill out of the menu while leaving it available for background use, and that project memory files can be written without a permission request. It also shows a denial-of-wallet path, with one URL-summary task costing $0.0274 on a small model at low effort and $0.1451 when the skill specifies a larger model at high effort. The write-up records no vendor acknowledgement or fix.