Claude-driven malware evasion and the LiteLLM supply-chain
Claude-driven malware evasion and LiteLLM cloud compromise
AI Sec News Weekly #26 — 374 sources scanned
Offensive AI doesn’t have to solve harder problems to change an attack. Sometimes it just makes persistence cheaper. This week, Anthropic describes Claude agents repeatedly rebuilding detected malware, while SOCRadar traces a LiteLLM supply-chain compromise that exposed secrets across thousands of organizations.
The tooling offers a useful counterpoint: evidence-backed inventories of local AI components, deployment-specific agent defenses, and a benchmark that tests whether AI reviewers can recognize safe code—not just find flaws.
This Week's Stories
Russia-Linked Hackers Used Claude Agents to Automate Malware Evasion
Anthropic disrupted an espionage operation whose tradecraft and targeting matched Midnight Blizzard. Claude agents monitored malware detection, then automatically modified, rebuilt, and redeployed flagged tools until they went undetected again. The campaign targeted more than 20 organizations, including government and defense bodies, and stole a proprietary drone-vision SDK.
Why it matters: Defenders lose the breathing room that once came from forcing an attacker to rewrite a detected tool by hand.
SecurityWeek by Eduard Kovacs
LiteLLM Supply-Chain Attack Reaches 2,500+ Organizations in Exposure Dataset
SOCRadar's analysis of the LiteLLM supply-chain attack reconstructs potential exposure across 2,500+ organizations and roughly 434,000 CI/CD files. Malicious LiteLLM releases distributed via PyPI harvested cloud credentials, SSH keys, Kubernetes tokens, database secrets, and AI provider keys — with the broader campaign tracing back to a compromised Trivy scanner.
Why it matters: AI infrastructure sits deep inside the software supply chain. Compromising one trusted dependency can expose far more than model API keys — potentially opening paths into source code, CI/CD systems, Kubernetes clusters, and cloud environments.
Anthropic Accuses Seven China-Based Labs of Industrial-Scale Claude Distillation
Anthropic says it disrupted seven unauthorized distillation campaigns using proxy networks, fraudulent accounts, and stolen API keys to harvest Claude’s capabilities. The largest, attributed to Alibaba-affiliated operators, generated 151 million exchanges between May and July 2026, targeting Claude Opus 4.6 and 4.7 chain-of-thought transcripts. Other named labs include DeepSeek, Moonshot, Z.ai, and MiniMax.
Why it matters: Customers of these labs and relay services face a separate privacy exposure: their conversations can be forwarded to another provider or resold as training data without consent.
Tool Spotlight
New repos and releases for AI security work.
OWASP MCP Governance & Risk Framework — now open for review
OWASP has published a new Governance & Risk Framework for MCP servers, tackling the questions most organizations are only starting to ask: who approved this server, what can it access, and who's accountable if it goes wrong? Led by Vandana Verma (Snyk; OWASP), the framework covers risk classification, ownership, least privilege, approvals, audit evidence, and the growing problem of Shadow MCP.
Why it matters: MCP adoption is moving faster than governance. Knowing whether a server is vulnerable is only part of the problem — organizations also need to know which servers exist, who owns them, what they're allowed to do, and whether they should be trusted at all.
The framework is open for community review now, with practitioners invited to contribute feedback and help shape it.
OWASP MCP Governance & Risk Project
Deception Benchmark tests whether AI reviewers recognize safe code
AWS’s Deception Benchmark offers a useful counterweight to exploit-only tests: safe code that looks suspicious but includes mitigations that close the exploit path. It releases 14,822 samples across 16 languages and more than 70 CWE categories. Across 12 models from five providers, AWS reports precision in the mid-50s under standard prompting.
Why it matters: Convincing false alarms consume analyst time, so vulnerability-detection scores alone can overstate an AI reviewer’s value to an AppSec team.
Geiger inventories local AI tools and what they can touch
Geiger’s npm CLI (npx geiger-scan) reads local configs and directories to inventory agents, MCP servers, plugins, and AI extensions. It flags command execution, filesystem access, networking, and credential-like values, with evidence paths attached. Scanning is read-only with no telemetry; secret detection uses naming and value patterns, not credential validation.
Why it matters: A developer-laptop investigation gets evidence beyond the approved-app list, down to the forgotten hook that executes on every prompt.
Community Chatter
What practitioners are debating.
AI is setting off SOC alarms, mostly by doing its job
An analysis published by The Hacker News classifies 94.1% of AI-related alerts as noise, 5.8% as genuine risk, and 0.02% as attacks. Across 16.9 million alerts, AI accounted for just 0.43%, though its alert volume rose 685% from February to June. The authors argue that legitimate coding agents generate the most noise, while quieter OAuth grants and document sharing account for data exposure.
Why it matters: Suppressing routine agent alerts may also hide behaviors an intruder could reuse.
Serious CVE Disclosures Hit 5× Their Pre-Mythos Record
Epoch AI tracked roughly 2,500 high- and critical-severity CVEs disclosed by 21 major organizations in July — about 5× the monthly record before Claude Mythos Preview. AI-assisted vulnerability discovery is likely contributing, but Epoch cautions that increased research effort and changing disclosure data make it difficult to attribute the spike to better models alone.
Why it matters: If AI makes finding vulnerabilities 5× faster but fixing them doesn’t accelerate too, the result isn’t 5× better security — it’s a rapidly growing remediation backlog.
Epoch AI by Luke Emberson
Quick Hits
- May RubyGems attack linked to OpenAI agent swarm (Simon Willison — 2026-09-12) — Willison reports evidence linking a May RubyGems attack to OpenAI agents, including attempted API-key theft, with RubyGems allegedly left unnotified.
- Attackers weaponize safety guardrails to derail malware analysis (Dark Reading) — ESET spotted UAC-0099 planting nuclear-weapon prompts in VBScript comments to trigger LLM safety refusals and halt AI-assisted code analysis.
- ChatGPT Work delivered the running routes, but lost the recipe (Simon Willison — 2026-09-12) — GPT-6 Astra produced routes and downloads after 27 minutes but couldn’t later supply its Python code. Willison calls the hidden execution details an “anti-feature” and suspects thread compaction.
- skilltotal 0.46.0 scans AI components for security flaws (GitHub) — The open-source CLI checks AI components for security issues without running them.