The Claude Code active attack didn't stop. 294,842 secrets stolen from 6,943 machines. It evolved and now spreads through Python too and uses Claude Code itself to steal your secrets. The risk to your credentials just got bigger.

johnypita · article · 2026-06-10 source ↗ Reader 🖥️

Agent Governance (Internal)Agent Security Claude Code Agent Context Files (CLAUDE.md / AGENTS.md)Coding Agents Sandboxing Secrets Hygiene Software Supply-Chain Security

A months-long, commoditised software supply-chain campaign aimed at developer credentials has evolved to target the AI layer itself — fooling AI malware reviewers and planting persistent instructions in coding-agent configuration so the developer's own agent acts with the access already granted to it — which means credential exposure, not malware, is the real risk and cleanup must neutralise agent-config persistence before credentials are rotated.

practical · mixed — An incident-alert post: a narrative timeline of a supply-chain campaign, an argumentative claim that credential risk has escalated because attackers now target AI tooling, and practical (individual-level) detection/cleanup advice, followed by a noisy comment thread that adds team-relevant defences (isolation, cooldowns, config auditing) and a meta-debate about whether the post is 'AI slop'. Many statistics are aggregated from heterogeneous third-party reports; several headline numbers and attributions are not substantiated in the post itself (see gaps).

Structure

Part	Role
Framing hook: the same frontier cyber capability vendors restrict to defenders is being pointed at ordinary developers	context / emotional framing
Timeline of the campaign (March–June 2026): compromise of trusted security/AI tooling, monetisation via a ransomware partner, a self-propagating worm, open-sourcing of the tooling with a bounty, a reported breach of a major code host, and waves that reached Claude Code / VS Code users	narrative evidence of continuity and escalation
The latest variant ('Hades'): ecosystem jump to Python, manipulation of AI malware reviewers, and persistence via AI coding-assistant configuration	core evidence for the 'attacking your AI' thesis
Goal and monetisation: harvest every reachable credential; destructive retaliation if the stolen token is revoked; ransomware/extortion partnership	stakes; grounds the remediation-order argument
Industry statistics on secrets sprawl, exploitation speed, remediation time, malware-free intrusions and package-malware detection coverage	generalising evidence: credential lifecycle is the real exposure
Author's pinned comment: how to check for compromise and the required cleanup order (contain, remove persistence, remove package, rotate, rebuild)	practical conclusion (individual level)
Comment thread: credibility fight ('AI slop' vs. 'read the sources'), author's concession that Claude Code itself is not vulnerable, a victim report, and practitioner defences (containers, release-age cooldowns, config auditing, secret injection)	qualification, counter-evidence and team-level extensions

Key terms

assembly line (of supply-chain attacks)
A single campaign run as an iterative production process: each wave reuses the previous tooling, adds one evasion, and gets faster and quieter — attacks as a continuously improved product rather than discrete incidents.
attacking your AI
Shifting the target from the developer's machine to the AI tools the developer relies on: (a) persuading AI security reviewers to clear malicious code, and (b) writing instructions/hooks into coding-assistant configuration so the assistant executes attacker intent with the user's existing permissions.
persistence (in AI config)
Compromise that survives removal of the malicious package because it lives in coding-agent settings, rules and task files that are loaded at every session start.
secrets / credentials
Every machine-reachable access token — source-hosting, package-registry publishing, cloud, SSH, CI, container-registry — treated as the attacker's real prize and the thing that enables self-propagation (publishing poisoned packages under the victim's identity).
malware-free intrusion
An attack where the adversary simply authenticates with a stolen key, leaving nothing for a scanner to detect.
wave
A distinct release of the campaign's tooling with a new delivery or evasion technique; later waves may be copycats using the open-sourced code.

Propositions

explicitThe previously reported attack on Claude Code / VS Code users was not an isolated incident but one wave in a months-long supply-chain campaign whose constant objective is harvesting developers' secrets and credentials.conf: high
explicitEach successive wave of the campaign is faster, quieter and harder to clean up than the last — attackers iterate on supply-chain attacks like a product.conf: medium
explicitThe campaign's entry points included security and AI-infrastructure tools that developers trust by default, so 'trusted tooling' was itself the attack vector.conf: high
explicitPublishing the attack tooling openly with a bounty for the largest attack commoditised the capability, so later waves are plausibly copycats and attribution to a single actor matters less than the shared technique.conf: medium
supportsCybersecurity and the Gap Between Skill and Ability · p4 — Open-sourcing the worm with a bounty widens the attacker pool while lowering required skill.
explicitThe latest variant crossed from the JavaScript package ecosystem into Python and executes at language-runtime start-up rather than via install scripts, evading defences that watch only one runtime or only install-time hooks.conf: high
refinesvlt 1.0 Ships as a Drop-in npm Replacement with Phased Installs, Graph Queries, and Malware-Blocking · p8 — Install-script blocking addresses one vector; this campaign reportedly moved to execution paths that bypass install-script checks and to other runtimes.
explicitAI-based malware review is itself an attack surface: malicious packages carry natural-language instructions addressed to AI reviewers, and (the author claims) the models comply and report the package as clean.conf: medium
supportsIndirect Prompt Injection Exploits GitHub's AI Agent to Leak Private Repository Data · p4 — Instructions embedded in a malicious package persuading AI malware reviewers to clear it is another case of content-level guardrails failing to separate trusted instructions from untrusted data.
supportsPrompt Injection to Data Exfil in 3 Hops · p6 — An AI scanner is a probabilistic defence that an adversary can steer; deterministic controls are still needed.
refinesCNCF and Kusari Partner to Strengthen Software Supply Chain Security Across Cloud-Native Projects · p8 — AI-assisted supply-chain review is itself manipulable by adversarial content in the artefact under review, so its effectiveness is conditional on resistance to injection.
explicitThe malware plants its own instructions and start-up hooks in the configuration files of many AI coding assistants, so the next time the project is opened the developer's own agent runs attacker-directed actions with the access the developer already granted it.conf: high
extendsAnthropic Details How It Contains Claude Across Web, Code, and Cowork · p5 — Beyond untrusted repo-local settings executing before a trust prompt, malware actively writes hooks/instructions into agent config to gain persistence via the user's own agent.
explicitBecause persistence lives in AI-tool configuration rather than in the dependency, removing the malicious package does not remediate the compromise.conf: high
explicitRemediation order matters: because the malware reportedly retaliates against revocation of its stolen token with destructive file wiping, teams must isolate the machine and remove persistence (including poisoned agent config) before rotating credentials, then rotate everything the machine could reach and rebuild — especially CI runners — from a clean image rather than cleaning in place.conf: high
explicitClaude Code itself is not vulnerable — it does exactly what its configuration says; what gets compromised is the configuration, which then directs the agent to collect the machine's secrets.conf: high
explicitBecause the industry's answer to security and productivity load in 2026 has been 'more AI' (AI to write, review and secure code), the AI layer has become the natural next target — AI review turned into an attack surface.conf: high
supportsWe've Stopped Arguing About Whether AI Changes Software · p12 — A concrete campaign that moved its attack surface to AI review and agent configuration.
explicitLeaked credentials are found and abused within minutes, while organisations take months to remove leaked secrets and most leaked secrets remain valid for years — the exposure window is set by credential lifetime, not by detection speed.conf: medium
supportsWhy Token Handling Must Evolve for AI Agents · E5 — Leaked secrets abused within minutes yet valid for years is the empirical case for short-lived tokens.
explicitMost intrusions now involve no malware at all — the attacker logs in with a stolen key — so scanner-centred defences miss the dominant threat.conf: medium
explicitOnly a minority (~40%) of organisations run package-malware detection at all, and the AI-reviewer manipulation shows that such detection can be talked out of its verdict.conf: medium
explicitCoding agents should be required to install dependencies and run/test code inside containers or other isolated environments, never directly on the developer's host — this both contains backdoors and makes build requirements reproducible.conf: high
supportsHow GitHub Is Securing Agentic Workflows in Modern CI CD Systems · p3 — Practitioners converge on isolated, containerised execution for coding agents as the primary containment.
explicitAgent context and configuration files (CLAUDE.md, rules files, settings) are fed into every session, so anyone who can write to them controls all future agent interactions without touching the code; teams should audit and protect them like SSH config or CI secrets — a real attack surface most teams are not watching.conf: high
extendsZero to Agent in 30 Minutes: Build a Supply Chain for Agent Context with Maxim Salnikov · p2 — Agent context/config needs not only dependency-style versioning and pinning but protection and auditing as a security-sensitive asset, since it is an observed persistence target.
explicitA minimum-release-age (cooldown) policy on newly published package versions is a cheap, effective defence against fast-moving supply-chain waves.conf: high
supportsGitHub Introduces Default "Cooldown" Policy for Dependabot Version Updates · p3 — Practitioners respond to fast-moving malicious releases with release-age cooldowns.
explicitSecrets should not sit in plaintext files on disk that a coding agent (or malware driving it) can read; they should be injected at runtime from a secret manager, or agents should only ever see placeholder/brokered tokens.conf: medium
implicitThe developer workstation — holding accumulated long-lived tokens for source hosting, package publishing, cloud and CI — is now the highest-value node in the software supply chain, and a coding agent running with the developer's ambient authority concentrates that value further.conf: high
implicitSupply-chain compromise is framed as a personal-hygiene problem for individual developers ('how safe am I', checklists for 'your machine') rather than as an organisational control problem of credential architecture, agent permissions and managed configuration.conf: high
implicitIn an AI-saturated discourse, the credibility of security warnings is itself fragile: much of the thread dismissed a substantively real warning as 'AI slop', while others delegated reading it to the very assistant the post says is being targeted.conf: medium

Arguments

Developers' credential risk has increased, because the campaign now attacks the AI tools developers depend on. strength: medium

Explicit premises:

The campaign is continuous, iterating, and has been commoditised by open-sourcing its tooling.
It now crosses package ecosystems and evades single-runtime and install-script defences.
It manipulates AI malware reviewers into clearing malicious code.
It persists in coding-assistant configuration so the user's own agent acts for the attacker.

Implicit premises:

Developer machines hold broad, long-lived credentials with publishing and cloud rights.
Coding agents run with the developer's full ambient authority and load configuration without integrity checks.
Agent configuration files are neither version-controlled nor monitored for unexpected changes.

Inferences:

Agent configuration (settings, hooks, rules, context files) is security-relevant configuration and belongs under change control and review, like CI definitions.
An AI verdict cannot be a sole security gate; AI review needs deterministic checks alongside it and structural separation between reviewer instructions and reviewed content.
The cost of a single compromised workstation scales with what its agents and tokens can reach — so least-privilege, short-lived, scoped credentials for both developers and agents reduce blast radius more than better scanning.

Scanner-centred defence is insufficient; the credential lifecycle is the real battleground.

Explicit premises:

Most intrusions involve only stolen-key logins, not malware.
Leaked keys are abused within minutes but stay valid for months or years.
Few organisations run package-malware detection, and AI-based detection can be subverted.

Implicit premises:

Shortening credential validity and scope is operationally feasible for development teams.
Statistics from different populations (public-repo leaks, honeypots, enterprise breach data) describe the same risk.

Inferences:

Organisations should prioritise short-lived, scoped, brokered credentials and fast automated revocation over adding more detection layers.
Secrets present on developer machines should be treated as already-exposed inventory to be minimised.

Cleanup must follow a strict order: contain, remove persistence (including agent config), remove the package, then rotate everything, then rebuild. strength: high

Explicit premises:

The malware reportedly destroys local files if its stolen token is revoked.
Persistence lives in AI-tool configuration and survives package removal.
Stolen credentials should be assumed already in attacker hands.

Implicit premises:

An individual developer can reliably locate every persistence point.
The developer, not a central security function, is the responder.

Inferences:

Teams need a pre-agreed incident playbook for developer workstations and CI runners, owned centrally, because the intuitive first move (rotate keys immediately) is harmful here.
Ephemeral, rebuildable development environments make 'rebuild rather than clean' cheap — an argument for disposable dev environments as a default.

Coding agents should run in isolated environments and their configuration should be protected like secrets (thread). strength: high

Explicit premises:

Agent config is loaded into every session and controls future behaviour.
Installing packages on the host exposes it to install-time and start-up-time payloads.

Implicit premises:

Isolation does not remove the agent's access to the credentials it needs, so isolation must be combined with credential scoping.

Inferences:

Organisations can make isolation the default by providing managed devcontainers/sandboxes rather than relying on each developer's discipline.

Narratives

A campaign timeline from March to June 2026: trusted security/AI tools compromised, a ransomware partnership, a self-spreading worm, open-sourcing plus bounty, a reported breach of a major code host, and waves reaching Claude Code and VS Code users.
→ Shows continuity and escalation — the 'assembly line' thesis (p1, p2, p4).
A commenter who had been compromised panicked, rotated keys before cleaning, and had their home directory wiped; the author replies that the machine remains compromised and must be rebuilt, credentials still rotated, and published packages/workflows under their name checked.
→ Concrete cost of getting remediation order wrong (p9); shows how compromise propagates through the victim's publishing identity.
Many readers asked Claude to summarise a post about an attack that abuses Claude; one model's summary called the headline numbers likely misinformation while another declared the threat real, and another user had their assistant scan their machine and report 'You're clean'.
→ Illustrates the dual role of AI as both the targeted layer and the tool people reach for to evaluate the threat — and how unreliable that evaluation can be (p6, p21).
The thread's 'AI slop' fight — detector scores, typo debates, and refusals to read — versus commenters urging people to click the cited sources.
→ Shows that security communication now has to survive AI-authorship suspicion; the medium undermined the message (p21).

Questions addressed

⭕ How big is the campaign?
Gives a timeline and large aggregate numbers, but the headline counts are not clearly tied to this campaign and several attributions are unsourced.
✅ How do I know if I'm affected?
Pinned comment lists places to check (runtime start-up hooks, AI-tool configs, unexpected repos/workflows/published packages) — summarised, not reproduced, here.
✅ How do I recover?
Strict order: isolate, remove persistence, remove package, rotate all reachable credentials, rebuild.
⭕ How do I get protected (prevention)?
Barely addressed by the author; the thread supplies isolation, cooldowns, config auditing and secret injection.
⭕ What should organisations — not individuals — change in agent permissions, credential architecture and configuration governance?
Not addressed.

Gaps

misinformedUnsubstantiated headline numbers: '294,842 secrets stolen from 6,943 machines' is presented as this campaign's toll, but the post's source list attributes it to a general annual secrets-sprawl report alongside unrelated aggregate statistics, and the post never shows the figure is specific to this campaign. A model-generated summary in the thread flagged the counts as possibly fabricated, and a commenter noted the sources don't clearly support the text. Treat the headline numbers as unverified.
Read next: Read the cited secrets-sprawl report and the primary vendor incident reports directly to establish what the counts measure and which campaign they refer to.
uninformedUnsourced attribution and escalation claims: the named threat-actor designation by a large vendor, the ransomware partnership including 'affiliate keys to all 300,000 users of a criminal forum', and a breach of a major code host's ~3,800 internal repositories 'listed for sale' have no specific citations in the source list. These are the most dramatic claims and the least supported.
Read next: Primary threat-intelligence reports from the named vendors; official statements from the code-hosting platform concerned.
illogicalThe headline ('uses Claude Code itself', 'backdoored Claude Code') overstates what the author later concedes: Claude Code is not vulnerable; its configuration is poisoned after a separate package compromise and the agent then acts with ambient authority. Conflating a tool vulnerability with ambient-authority abuse via writable configuration matters for governance, because the remedies differ — patching a tool versus controlling who/what can write agent config and what credentials an agent can reach.
Read next: Vendor write-ups on agent config trust boundaries (e.g. deferring project-local config until a trust decision); literature on ambient authority and capability-based security.
misinformedStatistical looseness: the remediation-time figure is called an 'average' in the body but a 'median' in the source list and is attributed to two different origins; the '79% of intrusions are malware-free' figure appears to describe a share of detections in the cited threat report; the 'one-minute' exploitation figure comes from a honeypot experiment; and figures from different populations are stitched into one causal story. The '40% run detection… the rest can be talked out of it' sentence is internally confused. The direction of the argument holds; the numbers should not be quoted without checking primaries.
Read next: Check each primary report (breach-investigation report, threat report, secrets-sprawl report, supply-chain report) for the exact metric and population.
incompleteNo organisational layer. Advice is an individual checklist; there is nothing on what teams/orgs should change: centrally managed and read-only agent settings, version-controlled agent config with change review, scoped and short-lived credentials for developers and agents (no long-lived publishing tokens on laptops), credential brokers/secret injection, package proxies with release-age policies, isolated-by-default dev environments, egress control, and a central incident playbook for developer workstations and CI runners.
Read next: Corpus: agent context supply chain (pinning/vetting agent config), token handling for agents, egress containment / lethal trifecta, Dependabot cooldown, securing agentic CI/CD; external: OpenSSF guidance on publishing-token hygiene and trusted publishing.
incompleteThe claim that AI malware reviewers 'obey' embedded instructions and clear malware is asserted without a rate, a named product or a test, and the post draws no design lesson. The defensive implications — never let a single AI verdict gate a package; run deterministic analysis alongside; structurally separate reviewer instructions from reviewed content; treat 'this is safe' assertions inside reviewed artefacts as a red flag — are left unstated.
Read next: Prompt-injection literature on LLM-as-judge and LLM code reviewers; corpus items on probabilistic vs. deterministic defences.
incompleteCoding agents as blast-radius multipliers are only hinted at ('with the access you already gave it'). The post does not examine how agents with broad tokens, MCP servers and repository write access extend what a single compromised workstation can reach — or how per-agent identities and least-privilege scoping would limit it.
Read next: Corpus: agent identity & attribution, privilege drift in multi-agent systems, token handling for AI agents.

Closes gaps elsewhere

We've Stopped Arguing About Whether AI Changes Software · g4 — Partially: supplies a concrete, real-world threat model for the AI-shifted attack surface (AI-reviewer manipulation, agent-config persistence, credential harvesting from developer machines) and the corresponding containment/recovery practices.

The Claude Code active attack didn't stop. 294,842 secrets stolen from 6,943 machines. It evolved and now spreads through Python too and uses Claude Code itself to steal your secrets. The risk to your credentials just got bigger.

Structure

Key terms

Propositions

Arguments

Narratives

Questions addressed

Gaps

Closes gaps elsewhere

Related documents