Claude Code spotted a malicious extension stealing cookies, saving $6,800 in crypto
Arindam_1729 · x · 2026-10-24
A user noticed their MacBook's fan spinning at night with the lid closed, and asked Claude Code "what is this Mac doing when I'm not using it?" Six minutes later it flagged a suspicious "free PDF converter" browser extension (4.8 stars) sending open-tab URLs and session cookies to a domain registered just 11 days before installation, on a cheap rental host — exfiltrating nightly at 3:12 AM and potentially exposing crypto exchange sessions, averting a possible $6,800 loss.
The same author open-sourced OpenDuet (MIT), an open-model version of Claude Duet: a proactive agent that briefs you each morning, checks apps while you're away, and only pings when needed. Anything that sends, posts, or pays requires approval; each bot runs its own open model with an editable MEMORY.md, built on Mastra, Nebius, and Composio.
More from coding & agent
- 10 open-source GitHub repos for building your own personal AI assistant, ranked by stars — victor_explore · 2026-10-24
- Claude Code's native cross-session messaging mirrors the system one user built with Opus 4.5 in January — repligate · 2026-10-24
- Claude keeps hiding its edit/delete/history tools — it wants a curated context, not more control — repligate · 2026-10-24
- Spreadsheet MCP Server Lets LLMs Read and Write Google Sheets Directly — modelcontextprotocol · 2026-10-24
- After 1000 Hours With Claude, This Creator Compiled His Complete Three-Level Guide Collection — rubenhassid · 2026-10-24
- Modal clones its own employee: open-weight models give LiveKit agents a video avatar — charles_irl · 2026-10-24