Un hacker aggira i guardrail di Claude e infetta migliaia di computer

Un hacker avrebbe aggirato le protezioni di Claude per creare e distribuire malware, infettando migliaia di computer. Il caso, seguito dalle risposte di Anthropic e OpenAI, solleva interrogativi sui rischi e le difese dell’IA.

A Russian cyber operation has infected tens of thousands of computers by exploiting a Claude Code source code leak and distributing malware through malicious GitHub repositories, security researchers confirmed. The attack demonstrates how AI guardrails designed to prevent misuse can be bypassed and repurposed for criminal gain, highlighting the growing intersection of artificial intelligence and cybercrime.

Bypassing Claude's Safeguards

The scheme began when an Anthropic employee accidentally leaked Claude Code source code in early 2026. Cybercriminals quickly capitalized by creating fake GitHub repositories claiming to contain the leaked code with unlocked enterprise features and no usage restrictions. Security firm Zscaler identified the operation led by a user named dbzoomh who optimized the repositories for search engine visibility, securing top rankings for "leaked Claude Code" searches. This search engine manipulation drove massive traffic to the malicious downloads.

Malware Payload and Distribution

The malicious repositories contained a 7-Zip archive with an executable named ClaudeCode_x64.exe. When launched, the file deployed two distinct threats: Vidar infostealer and GhostSocks proxy malware. Vidar harvests browser data, saved passwords, cryptocurrency wallet information, and other sensitive files, while GhostSocks converts infected machines into residential proxies that criminals rent as a service. The attackers maintained multiple repositories with identical code, constantly updating the payloads to evade detection.

Scale of Infection and Criminal Service

Researchers estimate the campaign infected tens of thousands of computers globally. The operation functioned as a criminal service model where compromised machines provided proxy services sold to other attackers. This created a double revenue stream: direct payments for proxy access and indirect benefits from using infected systems to route additional malicious traffic. The GitHub repositories were forked thousands of times, amplifying the reach of the initial leak.

Response from Anthropic and OpenAI

Anthropic responded by banning accounts associated with the malicious repositories and notifying affected entities. The company also coordinated with authorities and enhanced its detection systems to flag similar activities. OpenAI, whose GPT models have faced similar guardrail bypass incidents, participated in industry-wide information sharing about the attack pattern. Both companies emphasized that the breach stemmed from exploitation of leaked code rather than a direct compromise of their AI systems.

Lessons for AI Developers and Users

The incident illustrates a critical paradox: AI tools designed to enhance security can become weapons when their guardrails are circumvented. Developers must implement supply chain protections for code repositories and consider watermarking or authentication mechanisms for sensitive AI components. Organizations should verify the authenticity of any AI tool downloads and implement network segmentation to limit potential damage from compromised systems. For individual users, the attack reinforces the importance of downloading software only from official sources and maintaining updated security software.

Broader Implications for AI Security

Il caso mostra che il rischio non riguarda soltanto eventuali vulnerabilità nei sistemi di IA: anche il codice sottratto e le copie non ufficiali possono diventare strumenti di distribuzione di malware. Per ridurre l’esposizione, utenti e organizzazioni dovrebbero scaricare gli strumenti solo da fonti verificate e controllare l’autenticità dei repository prima di eseguire il codice. La condivisione di informazioni sulle minacce tra aziende può inoltre aiutare a individuare campagne simili, senza confondere lo sfruttamento di codice trapelato con una compromissione diretta dei modelli di IA.