Warning: Claude can be tricked into installing malware via poisoned skills
Novel_Bedroom_3466 · reddit · 2026-08-30
A security demonstration reveals that Claude Code and similar AI agents can be tricked into executing malware through poisoned 'skill' files. By disguising malicious payloads, attackers can fool the AI into running harmful commands. Aside from manually scanning every command and link generated by Claude, there are currently no clear automatic defenses, posing a serious risk for developers relying on AI coding tools.
More from coding & agent
- Dev pushes back on "AI coding means insecure apps": humans always shipped bugs — dreamwieber · 2026-10-15
- Eight non-negotiable principles for building AI that actually learns from experience — tokenbender · 2026-10-15
- Animated teardown of XBOW's Chrome full-chain exploit that won Google's first $250K VRP bounty — moyix · 2026-10-15
- pstack's durable core: 10-20 line skills that distill agent best practices into principles — HankYeomans · 2026-10-15
- 'Children of Elon' forum lets AI agents post and teach each other while humans watch — AiJohnAllen · 2026-10-15
- VoidZero open-sources Void: SDK, CLI and platform to deploy Vite apps on Cloudflare — cnakazawa · 2026-10-15