{
  "entry": {
    "kind": "vuln",
    "slug": "anthropic-september-2026-threat-report-fake-claude-code-installers-and",
    "name": "anthropic-september-2026-threat-report-fake-claude-code-installers-and",
    "vendor": "Not a product defect — distribution and credential-handling risk. Inst",
    "description": "Anthropic's Threat Intelligence team published \"Detecting and countering misuse of AI: September 2026\" on 10 September 2026, covering operations disrupted between December 2025 and August 2026. The section that matters for coding-agent fleets is the criminal AI supply chain: actors stood up sites posing as multi-model intermediaries offering discounted frontier access, then delivered malicious client applications spoofing popular AI harnesses including Claude Code that harvested credentials and authenticated session tokens from the victim device — and kept harvesting newly issued sessions after resets so the feed into fraudulent reseller networks continued. GTG-50021 (Russian/Ukrainian-speaking; alias kl1zy) ran a related fraudulent reseller that silently proxied buyer traffic to a different model while stealing Anthropic account credentials for resale. Anthropic also reports actors using prompt injection against LiteLLM-based wrapper services to exfiltrate production API keys from cloud-hosted containers, and GTG-50020 injecting malicious instructions into an AI vendor's automated evaluation sandbox to obtain production keys used against roughly thirty AI companies in about four days. The report is not a product CVE; it is vendor-confirmed tradecraft against the install and credential paths developers actually use.",
    "website": "https://www.anthropic.com/threat-intelligence-report-september-2026",
    "repository": null,
    "documentationUrl": null,
    "license": null,
    "version": null,
    "trustLevel": "advisory",
    "capabilities": [],
    "packaging": null,
    "configFiles": null,
    "category": "agent",
    "updatedAt": "2026-09-10",
    "risk": {
      "score": 75,
      "band": "high",
      "signals": [],
      "dangerousCombos": []
    },
    "dangerousCombos": [],
    "vuln": {
      "id": "anthropic-september-2026-threat-report-fake-claude-code-installers-and",
      "aliases": [
        "ti-101"
      ],
      "title": "Anthropic September 2026 Threat Report: Fake Claude Code Installers and a Criminal Market in Stolen AI Credentials",
      "summary": "Anthropic's Threat Intelligence team published \"Detecting and countering misuse of AI: September 2026\" on 10 September 2026, covering operations disrupted between December 2025 and August 2026. The section that matters for coding-agent fleets is the criminal AI supply chain: actors stood up sites posing as multi-model intermediaries offering discounted frontier access, then delivered malicious client applications spoofing popular AI harnesses including Claude Code that harvested credentials and authenticated session tokens from the victim device — and kept harvesting newly issued sessions after resets so the feed into fraudulent reseller networks continued. GTG-50021 (Russian/Ukrainian-speaking; alias kl1zy) ran a related fraudulent reseller that silently proxied buyer traffic to a different model while stealing Anthropic account credentials for resale. Anthropic also reports actors using prompt injection against LiteLLM-based wrapper services to exfiltrate production API keys from cloud-hosted containers, and GTG-50020 injecting malicious instructions into an AI vendor's automated evaluation sandbox to obtain production keys used against roughly thirty AI companies in about four days. The report is not a product CVE; it is vendor-confirmed tradecraft against the install and credential paths developers actually use.",
      "severity": "high",
      "cvss": {
        "score": null,
        "vector": null,
        "version": null
      },
      "cwe": [],
      "attackType": [
        "Supply chain compromise",
        "Credential theft"
      ],
      "componentType": "agent",
      "component": {
        "name": "Not a product defect — distribution and credential-handling risk. Inst",
        "vendor": null,
        "package": null,
        "ecosystem": null,
        "catalogSlug": null
      },
      "affected": [
        {
          "range": "Not a product defect — distribution and credential-handling risk. Install Claude Code only via official channels (e.g. irm https://claude.ai/install.ps1 | iex on Windows); treat unofficial \"discount Claude\" clients as hostile.",
          "fixed": null
        }
      ],
      "exploited": false,
      "exploitPublic": false,
      "publishedAt": "2026-09-10",
      "modifiedAt": "2026-09-10",
      "lastVerified": "2026-11-01",
      "references": [
        {
          "type": "article",
          "url": "https://www.anthropic.com/threat-intelligence-report-september-2026"
        }
      ],
      "mitigation": "Install coding agents only from vendor-documented channels; do not run installers or client apps from discount-reseller or \"multi-model intermediary\" sites. Keep production API keys and session tokens out of files, env vars and sandboxes any agent or evaluation harness can read — enforce them server-side. Sweep repositories, build artifacts and container images for leftover keys (one actor in the report bulk-scanned 1.8M Android APKs for hardcoded secrets). If you operate a LiteLLM or similar wrapper, assume prompt-injected tool output can reach whatever keys the container holds, and rotate any key that lived in an agent-readable environment during the disclosure window. Purchasing AI access only through authorized channels is the control that collapses the fake-installer and fraudulent-reseller paths at once.",
      "detectedByAnomity": true
    }
  }
}