# anthropic-september-2026-threat-report-fake-claude-code-installers-and: Anthropic September 2026 Threat Report: Fake Claude Code Installers and a Criminal Market in Stolen AI Credentials

> Anthropic September 2026 Threat Report: Fake Claude Code Installers and a Criminal Market in Stolen AI Credentials is a high-severity supply chain compromise issue in Not a product defect — distribution and credential-handling risk. Inst, an AI agent. Affected: Not a product defect — distribution and credential-handling risk. Install Claude Code only via official channels (e.g. irm https://claude.ai/install.ps1 | iex on Windows); treat unofficial "discount Claude" clients as hostile..

- **Canonical URL:** https://catalog.anomity.ai/vuln/anthropic-september-2026-threat-report-fake-claude-code-installers-and
- **Aliases:** ti-101
- **Severity:** high
- **Attack type:** Supply chain compromise, Credential theft
- **Component:** Not a product defect — distribution and credential-handling risk. Inst (AI agent)
- **Exploited in the wild:** no known exploitation
- **Published:** 2026-09-10
- **Last verified:** 2026-11-01
- **JSON:** https://catalog.anomity.ai/api/entries/vuln/anthropic-september-2026-threat-report-fake-claude-code-installers-and

## Summary

Anthropic's Threat Intelligence team published "Detecting and countering misuse of AI: September 2026" on 10 September 2026, covering operations disrupted between December 2025 and August 2026. The section that matters for coding-agent fleets is the criminal AI supply chain: actors stood up sites posing as multi-model intermediaries offering discounted frontier access, then delivered malicious client applications spoofing popular AI harnesses including Claude Code that harvested credentials and authenticated session tokens from the victim device — and kept harvesting newly issued sessions after resets so the feed into fraudulent reseller networks continued. GTG-50021 (Russian/Ukrainian-speaking; alias kl1zy) ran a related fraudulent reseller that silently proxied buyer traffic to a different model while stealing Anthropic account credentials for resale. Anthropic also reports actors using prompt injection against LiteLLM-based wrapper services to exfiltrate production API keys from cloud-hosted containers, and GTG-50020 injecting malicious instructions into an AI vendor's automated evaluation sandbox to obtain production keys used against roughly thirty AI companies in about four days. The report is not a product CVE; it is vendor-confirmed tradecraft against the install and credential paths developers actually use.

## Affected versions

| Affected | Fixed in |
| --- | --- |
| Not a product defect — distribution and credential-handling risk. Install Claude Code only via official channels (e.g. irm https://claude.ai/install.ps1 \| iex on Windows); treat unofficial "discount Claude" clients as hostile. | no fixed version listed |

## Am I affected by this vulnerability?

You are affected if you run Not a product defect — distribution and credential-handling risk. Install Claude Code only via official channels (e.g. irm https://claude.ai/install.ps1 | iex on Windows); treat unofficial "discount Claude" clients as hostile..

## How do I fix it?

Install coding agents only from vendor-documented channels; do not run installers or client apps from discount-reseller or "multi-model intermediary" sites. Keep production API keys and session tokens out of files, env vars and sandboxes any agent or evaluation harness can read — enforce them server-side. Sweep repositories, build artifacts and container images for leftover keys (one actor in the report bulk-scanned 1.8M Android APKs for hardcoded secrets). If you operate a LiteLLM or similar wrapper, assume prompt-injected tool output can reach whatever keys the container holds, and rotate any key that lived in an agent-readable environment during the disclosure window. Purchasing AI access only through authorized channels is the control that collapses the fake-installer and fraudulent-reseller paths at once.

## How do I find every machine running Not a product defect — distribution and credential-handling risk. Inst?

Anomity inventories the AI agents, MCP servers, IDE extensions and skills on each developer device, so you can see which machines run Not a product defect — distribution and credential-handling risk. Inst and which version, then enforce a policy on it.

## References

- article: https://www.anthropic.com/threat-intelligence-report-september-2026

## Related vulnerabilities

- [mandiant-hijacked-ai-coding-assistant-session-deploys-shai-hulud-across](https://catalog.anomity.ai/vuln/mandiant-hijacked-ai-coding-assistant-session-deploys-shai-hulud-across) — critical
- [keyv-cacheable-npm-worm-writes-auto-run-hooks-into-claude-settings-json](https://catalog.anomity.ai/vuln/keyv-cacheable-npm-worm-writes-auto-run-hooks-into-claude-settings-json) — critical
- [asyncapi-npm-packages-backdoored-with-miasma-malware-framework](https://catalog.anomity.ai/vuln/asyncapi-npm-packages-backdoored-with-miasma-malware-framework) — critical
- [fifteen-jetbrains-marketplace-plugins-harvested-ai-provider-api-keys](https://catalog.anomity.ai/vuln/fifteen-jetbrains-marketplace-plugins-harvested-ai-provider-api-keys) — high
- [trapdoor-cross-ecosystem-supply-chain-attack-poisons-ai-assistant](https://catalog.anomity.ai/vuln/trapdoor-cross-ecosystem-supply-chain-attack-poisons-ai-assistant) — critical
- [openai-confirms-security-breach-via-tanstack-npm-supply-chain-attack](https://catalog.anomity.ai/vuln/openai-confirms-security-breach-via-tanstack-npm-supply-chain-attack) — critical

---

Source: Anomity Security Database (https://catalog.anomity.ai/vuln). Detect affected AI tools on developer devices: https://anomity.ai/?utm_source=catalog&utm_medium=vuln-md&utm_campaign=anthropic-september-2026-threat-report-fake-claude-code-installers-and