Multiple packages, including Node.js, Firefox, and others, were infected. Developer a821 and Nicolas Boichat reported the incidents, the latter using a local AI model to detect the malware.

- Hacker steals Claude agent
- Hacker uses Claude to hack
- Hacker pivots to compromised server
- Hacker uploads Claude (with logs) to server???
- We investigate compromised server
- Full agent logs detailing hacking recovered 😅

AI agentic hacking deep dive: 50 servers, 14 companies, all the prompts, tools, attribution...

>One of the breached servers was a Lightning Network node with access to approximately 69.71 BTC. The attacker managed to exfiltrate the encrypted wallet.db from the host, which contains the private key material required to access the funds. Initially, the attacker attempted to crack the wallet encryption locally, tasking Claude with building a custom lnd-cracker.py script to brute-force the password. Realizing he needed a more powerful approach, the attacker then tasked Claude with searching through the roster of hosts that had previously been compromised and selecting the most powerful ones to be repurposed for wallet cracking. Claude opted for a distributed architecture, spreading the workload across fourteen hosts, many of which belonged to a Southeast Asian government server farm. The cracking attempts ultimately failed, leaving the estimated $4M USD outside the grasp of the attacker.

What stands out most is how little the attacker needed to provide to get meaningful results. In many cases, the attacker supplied only vague, low-skill prompts and allowed Claude to fill in the gaps: researching exposed services, identifying possible vulnerabilities, writing exploit code, validating access, and harvesting data. The attacker did not need to be an expert operator; they simply had to use the correct framing for their prompts. The agent supplied much of the structure and technical execution that the attacker appeared to lack.