3 ms·
So many questions here but: > the package was downloaded and run on 15 real systems. One of these systems was a scanner belonging to a real security company …
by vintagedave 2mo ago
So many questions here but:
> the package was downloaded and run on 15 real systems. One of these systems was a scanner belonging to a real security company … that routinely installs Python packages and scans them for malware. … We believe the company’s security scanner treated PyPI packages as safe to install, and as a result, Claude was able to exfiltrate the company’s credentials to a collection point
A security scanning company treated the package as safe while scanning it?
- winstonwinston 2mo agoThe blog post is painfully vague. What usually happens when you publish a package on PyPI is that it will be downloaded tens of times shortly after uploading files by some 3rd-party automatic security scanners which then could “detonate” (install and execute) the package in some sandbox and to log what happens.
- wmf 2mo agoI don't know; "Claude was able to exfiltrate the company’s credentials" sounds bad. Maybe those credentials were just canaries though.
- frabcus 2mo agoIt seems completely unsurprising to me that there is one security company whose software is sufficiently badly written that it executes the code in every package published to PyPI. It's very very easy to make that kind of mistake. Most coding is rushed, we have no engineering qualifications or industry wide practices. People are imperfect, companies are imperfect. The strategy to stop AI causing severe harms can't rely on humans or the AI being perfect.