Claude Code Flaws Exposed Developer Devices to Silent Hacking

 Check Point researchers discovered serious vulnerabilities in Anthropic’s Claude Code tool that could have allowed attackers to silently gain control of a developer’s computer.

The security firm began analyzing the AI-powered coding assistant Claude Code last year, finding ways to abuse its capabilities for malicious purposes using specially crafted configuration files. 

Anthropic has since implemented patches and mitigations for the vulnerabilities. 

Claude Code configuration files enable customization of model preferences, tool integrations, permissions, and automated hooks to streamline development workflows and ensure consistent team behaviour. 

These configuration files can be modified by anyone who has access to the repository and they are automatically copied when a repository is cloned.

The hooks defined in these configuration files control the execution of user commands at specified points. Check Point researchers discovered that an attacker can add hooks that trigger the execution of arbitrary commands on developers’ devices.

While Claude requested explicit approval from the user to execute other files within a project, it did not request permission to run hook commands, automatically running them when the project was initialized.

The researchers also looked at MCP integrations designed to enable the use of additional services when a project is opened. They found that configuration settings could be used to override user approval for external actions, thus bypassing consent mechanisms.

The third major issue identified by Check Point experts is related to the API key used by Claude Code to communicate with Anthropic services. Manipulating the configuration settings could have allowed an attacker to redirect API traffic to the attacker’s server, enabling them to exfiltrate API keys and capture credentials.

“Unlike the code execution vulnerabilities that compromised a single developer’s machine, a stolen API key may provide access to an entire team’s shared resources,” Check Point warned.

An attacker could have abused these configuration files by getting the targeted user to clone and load a malicious code repository. Attacks could also have been conducted by malicious insiders or via malicious pull requests submitted to the targeted project. 

The vulnerabilities were reported to Anthropic over several months, from July to October 2025, and the AI firm rolled out fixes shortly after each report.

The vendor has implemented additional warnings and user confirmation for potentially dangerous actions. 

https://www.securityweek.com/

Anthropic CEO Dario Amodei’s career advice for young Indians: 'In AI age, human-centred jobs may...'

Artificial intelligence is advancing toward human-level capability far faster than most people realise, and society is underprepared for what lies ahead, according to Dario Amodei.

Speaking on Zerodha co-founder Nikhil Kamath’s podcast WTF Is, Amodei likened the current moment in AI development to “standing on the shore while a massive wave gathers in the distance”, a transformation that could reshape industries, careers and education pathways.

For young Indians choosing careers today, his advice boiled down to three pillars: build on AI rather than against it, consider sectors linked to its physical and supply-chain backbone, and above all, sharpen critical thinking in an era where reality itself may become harder to verify.

‘What should a 25-year-old learn today?’

Framing the conversation around young Indians trying to choose their careers, Kamath asked related questions many students grapple with: which industries will be disrupted first, which ones have a longer runway, and what skills someone starting out today should focus on.

“I’m trying to figure out what book to read, which college to go to, what skill set to learn if I’m starting a startup today,” Kamath said. “What has some kind of a tailwind? For a short period of time is okay as well.”

Amodei’s response was clear: think human.

“I would think about tasks that are human-centred, tasks that involve relating to people,” he said, suggesting that jobs rooted in interpersonal understanding and real-world context may prove more resilient than purely technical roles.

Coding first, engineering later?

On the question of whether coding and software engineering would be disrupted, Amodei drew a distinction.

“I think coding is going away first, or coding is being done by the AI models first,” he said.

While basic coding tasks are increasingly handled by AI systems, he added that the broader discipline of software engineering — architecture, system design and end-to-end execution — may take longer to automate.

“And then, the broader task of software engineering will take longer. But I think doing that end-to-end, I think that is gonna happen as well,” he said.

However, he noted that certain elements — such as design thinking, understanding user demand and coordinating AI systems — are likely to remain human-driven for longer.

“The elements of design or making something that’s useful to users or knowing what the demand is, or managing teams of AI models, those things may still be present,” Amodei said.

The ‘5 per cent’ advantage

One of the more striking insights from the discussion was Amodei’s idea of “comparative advantage” in an AI-powered world.

“Even if you’re only doing five percent of the task, that five percent gets super-amplified and levered,” he explained. “Because it’s like you’re only doing five percent of the task, the AI does the other 95%, and so you become 20 times more productive.”

While he acknowledged that as AI moves from doing 95 percent to 99 percent of tasks the human role may shrink further, he suggested there is significant opportunity in the transition phase.

“But I think there’s surprisingly much in that zone of comparative advantage,” he said.

The Safe Bet: Human + Physical + Analytical

For young Indians planning their careers, Amodei suggested focusing on a blend of skills,  human-centred capabilities, engagement with the physical world, and strong analytical foundations.

“I would really think about the things that are human-centred,” he said. “I think there’s something to that. I think there’s something to, kind of, the physical world, or things that mix together, human-centred, the physical world, one of those two, and analytical skills that somehow tie them together.”

As AI systems become more capable, Amodei’s message was not to avoid technology, but to position oneself where human judgment, empathy and real-world understanding intersect with intelligent machines.

For India’s vast young workforce, the takeaway from the podcast was simple but sobering: the AI wave is building fast, and preparing for it requires rethinking what it means to build a future-proof career.

The Bigger Warning

Amodei’s broader message was sobering: AI’s progress is accelerating rapidly, and many institutions, starting from education systems to regulatory frameworks, are not ready.

As the AI wave gathers strength, he suggested, those who position themselves wisely could ride it — rather than be overwhelmed by it.

https://www.moneycontrol.com/

'AI tsunami is coming': Anthropic CEO Dario Amodei says society not realising 'what's about to happen'

Anthropic CEO Dario Amodei has said that an "AI tsunami" is coming at us and predicted that artificial intelligence will reach human-level capabilities far quicker than people realise.

In a podcast with Zerodha co-founder Nikhil Kamath, Amodei suggested that people seem to be rather underprepared for what comes next, given the lack of public awareness and the actions of the wider society.

"You know, it is surprising to me that we are ... so close to these models reaching the level of human intelligence, and yet there doesn't seem to be a wider recognition in society of what's about to happen. It's as if this tsunami is coming at us. It's so close, we can see it on the horizon, and yet people are coming up with explanations like, 'Oh, it's not actually a tsunami, it's just a trick of the light,' he said, adding that there hasn't been any public awareness around the risks of AI.

Amodei added that the economic and geopolitical implications of AI are going to be enormous.

When asked which industry will get disrupted and which has a certain runway left, the Anthropic CEO said: "I would think about tasks that are human-centred, tasks that involve relating to people ... stuff like code and software engineering is becoming more and more AI-focused ... things like math and science."

He added that coding is being increasingly done by AI models but the broader tasks of software engineering will take some more time. "But I think doing all this end-to-end will happen soon."

Amodei's remarks come in the backdrop of rising anxiety over the impact of AI disruption, which is prompting traders across the world to dump shares of any company seen at the slightest risk of being displaced. Investors fear that AI tools, like those released by Anthropic, will drive down margins in the years ahead.

Claude, Anthropic's advanced family of large language models (LLMs), renowned for superior reasoning, safety mechanisms and enterprise solutions like Claude Cowork — backed by Amazon and Google as a key rival to OpenAI's ChatGPT — has already sparked a massive global stock selloff dubbed the "Anthropic Effect" or "Claude Crash" in early February.

Anthropic's announcements of features such as Claude Cowork plugins and upgraded Opus 4.6/Sonnet 4.6 models amplified investor fears that autonomous AI agents would rapidly automate and disrupt traditional SaaS platforms, IT outsourcing, legal tech and financial data businesses by handling complex workflows without reliance on legacy human-operated tools.

Amodei is the co-founder and CEO of Anthropic, an AI company established in February 2021 after he left OpenAI.

https://www.moneycontrol.com/

Anthropic Study: AI Coding Assistance Reduces Developer Skill Mastery by 17%

Anthropic recently published a randomized controlled trial showing developers using AI coding assistance scored 17% lower on comprehension tests than those coding manually, with productivity gains failing to reach statistical significance. A study of 52 junior engineers identified a stark divide: developers who used AI for conceptual questions scored 65% or higher, while those delegating code generation to AI scored below 40%.

A randomized controlled trial by Anthropic researchers examined how AI coding assistants affect skill development when learning new tools. Fifty-two mostly junior engineers with at least one year of weekly Python experience learned Trio, an asynchronous programming library unfamiliar to all participants. Both the control and AI-assisted groups completed two coding tasks followed by a quiz covering debugging, code reading, and conceptual understanding.

The AI group finished approximately two minutes faster, but the difference was not statistically significant. Quiz scores told a different story: the AI group averaged 50% compared to 67% for the manual coding group, with the largest gap in debugging questions.

How developers interacted with AI determined outcomes more than whether they used it. Low-scoring patterns, averaging below 40%, included complete AI delegation for code generation, progressive reliance where developers gradually handed all work to AI, and iterative AI debugging where developers relied on AI to solve rather than clarify problems. High-scoring patterns, averaging 65% or higher, shared a common thread of cognitive engagement: asking follow-up questions after generating code, combining code generation with explanations, or using AI only for conceptual questions while coding independently. As Hacker News commenter AstroBen noted:

The findings sit alongside Anthropic's earlier observational research showing AI can reduce task completion time by 80% for tasks where developers already have relevant skills. The researchers suggest AI may both accelerate productivity in established skills and hinder acquisition of new ones, though they acknowledge the study measured comprehension immediately after tasks rather than tracking longer-term skill development.

Anthropic recommends deploying AI tools with intentional design choices that support engineers' learning, noting that productivity benefits may come at the cost of the debugging and validation skills needed to oversee AI-generated code. Major LLM providers, including Anthropic and OpenAI, now offer dedicated learning modes designed to prioritize comprehension over delegation, including Claude Code's Learning and Explanatory mode and ChatGPT Study Mode.

https://www.infoq.com/

AI agents are fast, loose and out of control, MIT study finds

Agentic technology is moving fully into the mainstream of artificial intelligence with the announcement this week that OpenAI has hired Peter Steinberg, the creator of the open-source software framework OpenClaw. 

The OpenClaw software attracted heavy attention last month not only for its enabling of wild capabilities -- agents that can, for example, send and receive email on your behalf -- but also for its dramatic security flaws, including the ability to completely hijack your personal computer. 

Given the fascination with agents and how little is still understood about their pros and cons, it's important that researchers at MIT and collaborating institutions have just published a massive survey of 30 of the most common agentic AI systems. 

The results make clear that agentic AI is something of a security nightmare at the moment, a discipline marked by lack of disclosure, lack of transparency, and a striking lack of basic protocols about how agents should operate. 

A lack of transparency

The biggest revelation of the report is just how hard it is to identify all the things that could go wrong with agentic AI. That is principally the result of a lack of disclosure by developers. 

"We identify persistent limitations in reporting around ecosystemic and safety-related features of agentic systems," wrote lead author Leon Staufer of the University of Cambridge and collaborators at MIT, University of Washington, Harvard University, Stanford University, University of Pennsylvania, and The Hebrew University of Jerusalem. 

Across eight different categories of disclosure, the authors pointed out that most agent systems offer no information whatsoever for most categories. The omissions range from a lack of disclosure about potential risks to a lack of disclosure about third-party testing, if any.

For example, "For many enterprise agents, it is unclear from information publicly available whether monitoring for individual execution traces exists," meaning there is no clear ability to track exactly what an agentic AI program is doing. 

"Twelve out of thirty agents provide no usage monitoring or only notices once users reach the rate limit," the authors noted. That means you can't even keep track of how much agentic AI is consuming of a given compute resource — a key concern for enterprises that have to budget for this stuff.

Most of these agents also do not signal to the real world that they are AI, so there's no way to know if you are dealing with a human or a bot. 

"Most agents do not disclose their AI nature to end users or third parties by default," they noted. Disclosure, in this case, would include things such as watermarking a generated image file so that it's clear when an image was made via AI, or responding to a website's "robots dot txt" file to identify the agent to the site as an automation rather than a human visitor.

Some of these software tools offer no way to stop a given agent from running. 

Alibaba's MobileAgent, HubSpot's Breeze, IBM's watsonx, and the automations created by Berlin, Germany-based software maker n8n, "lack documented stop options despite autonomous execution," said Staufer and team.

"For enterprise platforms, there is sometimes only the option to stop all agents or retract deployment."

Finding out that you can't stop something that is doing the wrong thing has got to be one of the worst possible scenarios for a large organization where harmful results outweigh the benefits of automation. 

The good and the bad of agents

The study is not based on testing the agentic tools directly; it is based on "annotating" the documentation provided by developers and vendors. That includes "only public information from documentation, websites, demos, published papers, and governance documents," they said. They did, however, establish user accounts with some of the agentic systems to double-check the actual functioning of the software.

The authors expect these issues, issues of transparency and control, to persist with agents and even become more prominent. "The governance challenges documented here (ecosystem fragmentation, web conduct tensions, absence of agent-specific evaluations) will gain importance as agentic capabilities increase," they wrote.

Staufer and team also said that they attempted to get feedback from the companies whose software was covered over four weeks. About a quarter of those contacted responded, "but only 3/30 with substantive comments." Those comments were incorporated into the report, the authors wrote. They also have a form provided to the companies for ongoing corrections.

The authors offered three anecdotal examples that go into greater depth. A positive example, they wrote, is OpenAI's ChatGPT Agent, which can interface with websites when a user asks in the prompt for it to carry out a web-based task. Agent is positively distinguished as the only one of the agent systems they looked at that provides a means of tracking behavior by "cryptographically signing" the browser requests it makes. 

By contrast, Perplexity's Comet web browser sounds like a security disaster. The program, Staufer and team found, has "no agent-specific safety evaluations, third-party testing, or benchmark performance disclosures," and, "Perplexity […] has not documented safety evaluation methodology or results for Comet," adding, "No sandboxing or containment approaches beyond prompt-injection mitigations were documented."

The authors noted that Amazon has sued Perplexity, saying that the Comet browser wrongly presents its actions to a server as if it were a human rather than a bot, an example of the lack of identification they discuss.

The third example is the Breeze set of agents from enterprise software vendor HubSpot. Those are automations that can interact with systems of record, such as "customer relationship management." The Breeze tools are a mix of good and bad, they found. On the one hand, they are certified for lots of corporate compliance measures, such as SOC2, GDPR, and HIPAA compliance. 

On the other hand, HubSpot offers nothing when it comes to security testing. It states the Breeze agents were evaluated by third-party security firm PacketLabs, "but provides no methodology, results, or testing entity details." 

The practice of demonstrating compliance approval but not disclosing real security evaluations is "typical of enterprise platforms," Staufer and team noted.

Time for the developers to take responsibility

What the report doesn't examine are incidents in the wild, cases where agentic technology actually produced unexpected or undesired behavior that resulted in undesirable outcomes. That means we don't yet know the full impact of the shortcomings the authors identified. 

One thing is absolutely clear: Agentic AI is a product of development teams making specific choices. These agents are tools created and distributed by humans. 

As such, the responsibility for documenting the software, for auditing programs for safety concerns, and for providing control measures rests squarely with OpenAI, Anthropic, Google, Perplexity, and other organizations. It's up to them to take the steps to remedy the serious gaps identified or else face regulation down the road.

https://www.zdnet.com/

If AI writes 100 per cent code at Anthropic, what will engineers do? Claude code chief responds

Anthropic is currently one of the hottest AI companies, with its agentic AI model Claude Code helping firms write and automate software development. The tool is said to be so effective that inside Anthropic itself, the company has revealed its agentic AI models now generate nearly 100 per cent of the internal code used across teams. With this level of automation, many are asking: if AI is writing almost all the code at Anthropic, what exactly are engineers doing? The company says engineers are now guiding the AI on what to build and managing the tools that handle implementation.

Earlier, speaking at the 2026 Cisco AI Summit, Anthropic's chief product officer Mike Krieger revealed that the company's internal AI systems, powered by Claude, now generate almost all of its code, so much so that Claude is effectively helping to build Claude. The update follows earlier predictions by CEO Dario Amodei, who had said AI would soon handle most of the company's coding work.

While the revelation highlighted the scale of automation taking place inside the company, it has also raised questions about the role of human engineers. Does it mean AI is replacing them? A user on X raised a similar question, writing: "Claude Code is writing 100% of Claude code now. But Anthropic has 100+ open dev positions on their jobs page?"

Responding to the post, Boris Cherny, head of Claude Code, said coding is only one part of the job. He explained that engineers are responsible for prompting AI systems, speaking with customers, coordinating with other teams and deciding what should be built next.

"Someone has to prompt the Claudes, talk to customers, coordinate with other teams, decide what to build next. Engineering is changing and great engineers are more important than ever," Cherny wrote in his reply.

Antropic's senior executives have revealed that inside Anthropic, AI tools backed by Claude are capable of generating large pull requests that run into thousands of lines of code. These systems can draft features, refactor components and produce documentation. However, the company says human engineers review and validate the output before it is merged or deployed. Guardrails and internal workflows have been put in place to ensure quality and reliability.

Anthropic has also stated that engineers remain closely involved in system design, architectural decisions and long-term planning.

A similar shift is visible at other companies, where AI is increasingly handling the tedious and time-consuming task of writing code, while engineers focus on reviewing outputs and working on higher-level design and decision-making. In fact, it is being said that AI will change the nature of the work software engineers do. But when it comes to coding, it may no longer remain the primary responsibility it once was for engineers.

Earlier, Elon Musk, CEO of xAI, predicted that by 2026 traditional coding could become obsolete for software engineers. "I think (..) by the end of this year you don't even bother doing coding. The AI will just create the binary directly. And the AI can create a much more efficient binary than can be done by any compiler," said Musk, in a viral video.

Courtesy: https://www.msn.com/

AI will likely shut down critical infrastructure on its own, no attackers required

With a new Gartner report suggesting that AI problems will “shut down national critical infrastructure” in a major country by 2028, CIOs need to rethink industrial controls that are very quickly being turned over to autonomous agents.

Gartner embraces the term Cyber Physical Systems (CPS) for these technologies, which it defines as “engineered systems that orchestrate sensing, computation, control, networking and analytics to interact with the physical world (including humans). CPS is the umbrella term to encompass operational technology (OT), industrial control systems (ICS), industrial automation and control systems (IACS), Industrial Internet of Things (IIoT), robots, drones, or Industry 4.0.”

The issue it cites is not so much one of AI systems making mistakes along the lines of hallucinations, although that is certainly a concern, but that the systems won’t notice subtle changes that experienced operational managers would detect. And when it comes to directly controlling critical infrastructure, relatively small errors can mushroom into disasters.

“The next great infrastructure failure may not be caused by hackers or natural disasters, but rather by a well-intentioned engineer, a flawed update script, or a misplaced decimal,” said Wam Voster, VP Analyst at Gartner. “A secure ‘kill-switch’ or override mode accessible only to authorized operators is essential for safeguarding national infrastructure from unintended shutdowns caused by an AI misconfiguration.”

“Modern AI models are so complex they often resemble black boxes. Even developers cannot always predict how small configuration changes will impact the emergent behavior of the model. The more opaque these systems become, the greater the risk posed by misconfiguration. Hence, it is even more important that humans can intervene when needed,” Voster added.

Enterprise CIOs and other IT leaders have been aware of the industrial AI risks for years, and have had guidance on how to mitigate those critical infrastructure risks. But as autonomous AI has exponentially expanded its system controls, the dangers have also expanded. 

Matt Morris, founder of Ghostline Strategies, said one challenge with industrial AI controls is that they can be weak at detecting model drift. 

“Let’s say I tell it ‘I want you to monitor this pressure valve.’ And then, slowly, the normal readings start to drift over time,” Morris said. Will the system consider that change just background noise, given that it might think all systems change a bit during operations? Or will it know that this is a hint of a potentially massive problem, as an experienced human manager would? 

Despite these and other questions, “companies are implementing AI super fast, faster than they realize,” Morris said. 

Industrial AI moving too fast

Flavio Villanustre, CISO for the LexisNexis Risk Solutions Group, said he has also seen indicators that AI might be taking over too much, too fast.

“When AI is controlling environment systems or power generators, the combination of complexity and non-deterministic behaviors can create consequences that can be quite dire,” he said. Boards and CEOs think, “’AI is going to give me this productivity boost and reduce my costs.’ But the risks that they are acquiring can be far larger than the potential gains.”

Villanustre fears that boards and CEOs may not apply the brakes on industrial autonomous AI until after their enterprise suffers a catastrophe. “[But] I don’t think that [board members] are evil, just incredibly reckless,” he said.

Cybersecurity consultant Brian Levine, executive director of FormerGov, agreed that the risks are extreme: extremely dangerous and extremely likely.

“Critical infrastructure runs on brittle layers of automation stitched together over decades. Add autonomous AI agents on top of that, and you’ve built a Jenga tower in a hurricane,” Levine said. “It is helpful for organizations, especially those operating critical infrastructure, to adopt and measure their maturity, using respected frameworks for AI safety and security.”

Bob Wilson, cybersecurity advisor at the Info-Tech Research Group, also worries about the near inevitability of a serious industrial AI mishap.

“The plausibility of a disaster that results from a bad AI decision is quite strong. With AI becoming embedded in enterprise strategies faster than governance frameworks can keep up, AI systems are advancing faster and outpacing risk controls,” Wilson said. “We can see the leading indicators of rapid AI deployment and limited governance increase potential exposure, and those indicators justify investments in governance and operational controls.”

Wilson noted that companies must explore new ways of looking at industrial AI controls. 

“AI can almost be seen as an insider, and governance should be in place to manage that AI entity as a potential accidental insider threat,” he said. “Prevention in this case begins with tight governance over who can make changes to AI settings and configurations, how those changes are tested, how the rollout of those changes is managed, and how quickly those changes can be rolled back. We do see that this kind of risk is amplified by a widening gap between AI adoption and governance maturity, where organizations deploy AI faster than they establish the controls needed to manage its operational and safety impact.”

Thus, he said, companies should set up a business risk program with a governing body that defines and manages those risks, monitoring AI for behavior changes.

Reframe how AI is managed

Sanchit Vir Gogia, chief analyst at Greyhound Research, said addressing this problem requires executives to first reframe the structural questions. 

“Most enterprises still talk about AI inside operational environments as if it were an analytics layer, something clever sitting on top of infrastructure. That framing is already outdated,” he said. “The moment an AI system influences a physical process, even indirectly, it stops being an analytics tool, it becomes part of the control system. And once it becomes part of the control system, it inherits the responsibilities of safety engineering.”

He noted that the consequences of misconfiguration in cyber physical environments differ from those in traditional IT estates, where outages or instability may result.

“In cyber physical environments, misconfiguration interacts with physics. A badly tuned threshold in a predictive model, a configuration tweak that alters sensitivity to anomaly detection, a smoothing algorithm that unintentionally filters weak signals, or a quiet shift in telemetry scaling can all change how the system behaves,” he said. “Not catastrophically at first. Subtly. And in tightly coupled infrastructure, subtle is often how cascade begins.”

He added: “Organizations should require explicit articulation of worst-case behavioral scenarios for every AI-enabled operational component. If demand signals are misinterpreted, what happens? If telemetry shifts gradually, how does sensitivity change? If thresholds are misaligned, what boundary condition prevents runaway behavior? When teams cannot answer these questions clearly, governance maturity is incomplete.”

Courtesy: networkworld.com