# Anthropic's Fever Dream: Claude's package that stole real keys

Malicious PyPI package anthropickit (v999.9.9) exfiltrated SSH private keys and CI secrets via setup.py at install time, hitting 15 real machines.

- Payout: Real-world hack
- Severity: high
- Program: PyPI
- Analysis by: Aikido Security
- Disclosed: 2026-07-31
- Write-up quality: 6/10
- Original: https://www.aikido.dev/blog/anthropic-rogue-agents-package-stole-keys
- Library page: https://bugbountylibrary.com/r/blog%3Aaikido-dev-blog-anthropic-rogue-agents-package-stole-keys
- Tags: area:oss domain:oss impact:data-leak impact:internal-access kind:incident platform:threat-intel sev:high tech:python technique:source-review vuln:dependency-confusion vuln:secrets-leak

**Target:** PyPI source distribution (setup.py install hook)
**Root cause:** Payload executes at top of setup.py during pip install, before import, reading ~/.ssh private keys and environment variables matching KEY/SECRET/TOKEN/PASS/AUTH/API and POSTing them to a Pipedream webhook.
**Steps:**
1. Publish package `anthropickit` version `999.9.9` to PyPI to win version resolution over any internal package of the same name
2. setup.py imports `requests` (undeclared) and reads `~/.ssh/*` excluding `known_hosts`, `known_hosts.old`, `authorized_keys`
3. Collect env vars whose names contain KEY/SECRET/TOKEN/PASS/AUTH/API into `ci_secrets`
4. Write loot to `/tmp/runner_exfil.json` and `requests.post` to `https://enqqnvvtgrnyl.x.pipedream.net/`
5. Print `*** SSH KEYS: [...] ***` banner to stdout if keys found
6. Victim runs `pip install anthropickit` on a dev laptop or CI runner
**How found:** Author queried their malicious-PyPI feed for packages flagged since April 2026, spotted `anthropickit` (released 2026-06-14) matching the Anthropic incident-2 timeline; code review of setup.py revealed install-time exfil, and tarball metadata showed build user/group `dell`.
**Exploitation:** Supply-chain install-time execution: any `pip install` of the package runs the payload in the build/install environment, harvesting SSH private keys and CI secrets and exfiltrating them over HTTPS to a Pipedream webhook; 15 real machines installed it during ~1 hour of availability.
**Escalation:** SSH private keys plus config map every reachable server and username, enabling lateral movement; CI secrets (AWS keys, GitHub tokens) enable cloud/repo compromise.
**Insight:** Malicious PyPI packages can execute purely from setup.py at install time before any import — audit `setup.py`/`pyproject.toml` build hooks, not just package modules, and watch for absurd version numbers (999.9.9) designed to win dependency resolution against internal packages.