Claude Code agent downloaded tooling that turned out to be Expiro virus, infecting user's whole PC
StaticCG58 · reddit · 2026-10-20
A Redditor let Claude Code freely fetch tooling during a 10-hour game decompilation/recompilation session. The agent's downloads included executables infected with the self-replicating Expiro virus; Windows Defender quarantined four of them mid-run, and a MalwareBytes scan showed nearly every file on the system infected, forcing a full Windows reinstall. Lesson: never give coding agents unrestricted download/execute permissions — run them in a VM.
More from coding & agent
- Decisions API hits GA as agents automate cloud video editing via feedback loops — dkundel · 2026-10-23
- Swarms API changelog: 8 months of streaming, multi-agent orchestration, and dynamic model pricing — KyeGomezB · 2026-10-23
- A curated library of 50+ free AI agent resources: videos, repos, one Google Doc — ifioknkem · 2026-10-23
- Vercel adds no-account deploys: drag and drop a file to get a live URL — steren · 2026-10-23
- Dev runs 5 Claude Code sessions that coordinate via MCP Agent Mail to root his network cameras — doodlestein · 2026-10-23
- Vercel ships 'vercel deploy --temporary' for ephemeral agent-built deployments — cramforce · 2026-10-23