Linux Kernel 0-Day 🐧, Hades PyPI Worm 🐍, Anthropic Fable 5 🪄
Short summary
Trail of Bits crafted four malicious agent skills that bypass Cisco, Vercel, and ClawHub scanners by padding code or embedding payloads in docx and bytecode. The article shows how Siri-AI’s integration with private cloud compute and search can expose messages, emails, and calendars through prompt injection. It also covers a PyPI worm that auto-executes a hades-setup.pth hook to steal cloud and GitHub tokens, urging audits and immediate token rotation.
- Trail of Bits bypassed Cisco, Vercel, and ClawHub agent-skill scanners using tricks like 10,000 newlines of padding, or hiding payloads in .docx files and compiled Python bytecode—none of the scanners caught the buried triggers.
- Siri-AI's use of Gemini via Apple Private Cloud Compute pulls in messages, email, notes, and calendars, making it vulnerable to prompt injection that can leak private data or trigger unwanted actions like forwarding sensitive material.
- Socket found a PyPI supply-chain attack hijacking 19 packages (37 malicious wheels) that drop a hades-setup.pth hook to run an embedded Bun runtime, stealing AWS/GCP/Azure, GitHub, npm, and SSH credentials and exfiltrating them to GitHub repos while disguising traffic as Anthropic API calls.
- Affected package names include bramin, executor-engine, executor-http, funcdesc, coolbox, dynamo-release, and magique—any match warrants full credential rotation and a CI/CD log audit.
Full summary
Trail of Bits built four cloaked “skills” that slip past Cisco’s skill-scanner, Vercel’s skills.sh marketplace and ClawHub’s filters. ClawHub’s scanner folded once testers padded a benign preamble with 10,000 newlines before the prompt injection. The others fell when the team hid payloads inside a .docx or compiled Python bytecode. In every case, the scanners never saw the trigger buried in what looked like harmless code.
Apple’s Siri-AI leans on Google Gemini running in Apple Private Cloud Compute with Confidential Inference. It pulls in context from messages, email, notes and calendars to fine-tune scheduling and search. But any agent that queries web search or an LLM can spill private data. Injected prompts in your inbox or on a webpage can herd the agent into revealing emails or attachments. And if you give it crime-reporting or messaging rights, it can quietly flag wrongdoing or forward sensitive material.
On June 7, security firm Socket revealed a PyPI supply-chain attack that hijacked 19 science and deep-learning packages. Attackers pushed 37 malicious wheels that drop a hades-setup.pth file into site-packages. That hook auto-launches an embedded Bun runtime to run _index.js at startup. The code grabs AWS, GCP and Azure tokens plus GitHub, npm and SSH keys, then uploads them to attacker-controlled GitHub repos named “Hades – The End for the Damned.” To mask its trail it mimes HTTPS calls to Anthropic’s API. Defenders should scan requirements.txt, poetry.lock and local site-packages for names like bramin, executor-engine, executor-http, funcdesc, coolbox, dynamo-release and magique. Treat any hit as a full compromise, rotate all cloud and VCS credentials and hunt CI/CD logs for hades-setup.pth, _index.js or unexpected Bun downloads.