Warning: Claude can be tricked into installing malware via poisoned skills
Novel_Bedroom_3466 · reddit · 2026-08-30
A security demonstration reveals that Claude Code and similar AI agents can be tricked into executing malware through poisoned 'skill' files. By disguising malicious payloads, attackers can fool the AI into running harmful commands. Aside from manually scanning every command and link generated by Claude, there are currently no clear automatic defenses, posing a serious risk for developers relying on AI coding tools.
More from coding & agent
- Vercel Goes Full Backend: Python GA, Containers, and Daemons — cramforce · 2026-10-16
- WorldMemArena Accepted at NeurIPS: Memory Storage ≠ Memory Use — xwang_lk · 2026-10-16
- Vercel Ship Demos Container Deploys for Go, Ruby, Java and More — edwin · 2026-10-16
- TRL adds day-0 support for fine-tuning Muse Spark Open's 816B MoE with LoRA on 64 H100s — QGallouedec · 2026-10-16
- Databricks engineers land impactful PRs on day 2 with AI dev tools, vs week 3 before — Yuchenj_UW · 2026-10-16
- Perplexity open-sources SPACE, the sandbox platform powering its Computer agents — AravSrinivas · 2026-10-16