A developer leaked Anthropic’s real .claude folder containing 33 skills, a verifier subagent, and a seven-file harness. After integrating it locally, Claude stopped generating pointless tests and redundant confirmation prompts. The entire setup is now on GitHub with a one-line install script.

• A claimed "leaked" Anthropic internal .claude folder (33 skills, verifier subagent, 7-file harness) is being distributed via a one-line curl-to-bash install script on GitHub (Archive228/loopkit)
• Running curl-fsSL-piped-to-bash from an unverified repo to install unvetted "leaked" internal tooling is a significant security red flag, regardless of the productivity claims
• The claimed behavior changes (fewer test stubs, no false "done" markings, fewer confirmation prompts) are anecdotal and unverified, not benchmarked
• The framing pushes urgency ("bookmark before it disappears") which is a classic pressure tactic worth treating with suspicion rather than a substantive technical claim

Trail of Bits crafted four malicious agent skills that bypass Cisco, Vercel, and ClawHub scanners by padding code or embedding payloads in docx and bytecode. The article shows how Siri-AI’s integration with private cloud compute and search can expose messages, emails, and calendars through prompt injection. It also covers a PyPI worm that auto-executes a hades-setup.pth hook to steal cloud and GitHub tokens, urging audits and immediate token rotation.

• Trail of Bits bypassed Cisco, Vercel, and ClawHub agent-skill scanners using tricks like 10,000 newlines of padding, or hiding payloads in .docx files and compiled Python bytecode—none of the scanners caught the buried triggers.
• Siri-AI's use of Gemini via Apple Private Cloud Compute pulls in messages, email, notes, and calendars, making it vulnerable to prompt injection that can leak private data or trigger unwanted actions like forwarding sensitive material.
• Socket found a PyPI supply-chain attack hijacking 19 packages (37 malicious wheels) that drop a hades-setup.pth hook to run an embedded Bun runtime, stealing AWS/GCP/Azure, GitHub, npm, and SSH credentials and exfiltrating them to GitHub repos while disguising traffic as Anthropic API calls.
• Affected package names include bramin, executor-engine, executor-http, funcdesc, coolbox, dynamo-release, and magique—any match warrants full credential rotation and a CI/CD log audit.

The article discusses a recent supply chain attack involving the popular Axios package, highlighting how an attacker installed malware without altering the original code. It emphasizes the challenges posed by AI in both coding and attacking, as automated systems can easily introduce vulnerabilities faster than traditional security measures can respond.

• Attackers hijacked a maintainer account and slipped a self-deleting RAT into Axios (100M+ weekly downloads) via a malicious dependency, leaving no CVE for traditional scanners to catch.
• AI coding agents are 50% more likely than humans to pick known-vulnerable dependencies and often hallucinate package names that attackers exploit via "slopsquatting."
• Attacks have shifted from targeting single packages to automated, ecosystem-wide worms, like the TeamPCP campaign that spread through 66 npm packages in days.
• Socket detected the malicious Axios dependency in 6 minutes by analyzing code behavior, versus the industry-average 267 days for breach detection.