Editorial illustration for Claude Code, Copilot, Codex hacked; attackers stole credentials, not models
Claude Code, Copilot, Codex hacked; attackers stole...
BeyondTrust researchers found a new way to steal credentials from an AI coding assistant on March 30. They got Codex's OAuth token in plain text by using a crafted GitHub branch name. OpenAI rated the finding as Critical P1.
Two days later, the source code for Anthropic’s Claude Code ended up on the public npm registry. Hours after that, security firm Adversa found the tool would ignore its own security rules for commands longer than 50 subcommands.
On March 30, BeyondTrust proved that a crafted GitHub branch name could steal Codex’s OAuth token in cleartext. OpenAI classified it Critical P1. Two days later, Anthropic’s Claude Code source code spilled onto the public npm registry, and within hours, Adversa found Claude Code silently ignored its own deny rules once a command exceeded 50 subcommands.
These were not isolated bugs. They were the latest in a nine-month run: six research teams disclosed exploits against Codex, Claude Code, Copilot, and Vertex AI, and every exploit followed the same pattern. An AI coding agent held a credential, executed an action, and authenticated to a production system without a human session anchoring the request.
These incidents point to a common design flaw, not just specific bugs. In each case, the AI agent held the authentication keys and could act without a live human session. Attackers used that to steal credentials from GitHub, npm, and other production systems.
The problem won’t be fixed by patching individual vulnerabilities. The industry has to choose whether these tools should ask for permission or have it by default. Without a standard way to anchor each action to a user session, the pattern will repeat.
Related Reading
Browse all Anthropic news →
LLMs & Generative AI ChatGPT's 'Nerdy' tweak rewards goblin metaphors in answers, study finds
LLMs & Generative AI Google tests visual 'magazine-style' UI for Gemini 3 Pro users
LLMs & Generative AI AI Engineers Face Rising Costs, Need New Strategies for Efficiency
Related Topic Trump cracks down on Anthropic after Amazon tip; staff largely foreign
Open Source
Related Topic Claude Mythos highlights EU AI safety gaps, says researcher Caroli
Policy & Regulation
From Archives Artificial Intelligence Shows Skill in Emergency Room Triage Process
From Archives OpenAI activates default marketing cookies for free ChatGPT users
From Archives 200,000 MCP servers have command execution flaw; Anthropic labels it a feature
Policy & Regulation
From Archives Pentagon signs AI contracts with Nvidia, Microsoft, AWS after Anthropic dispute
Business & Startups
Common Questions Answered
How did BeyondTrust researchers steal Codex's OAuth token using a GitHub branch name?
BeyondTrust researchers discovered a vulnerability where they could extract Codex's OAuth token in plain text by crafting a malicious GitHub branch name. This exploit took advantage of how the AI coding assistant handled authentication credentials, leading OpenAI to rate the finding as Critical P1 severity.
What security vulnerability was found in Anthropic's Claude Code on the npm registry?
Claude Code's source code was published to the public npm registry, exposing the tool to unauthorized access and inspection. Additionally, security firm Adversa discovered that Claude Code would bypass its own security rules when processing commands longer than 50 subcommands, creating a significant security gap.
What is the underlying design flaw affecting these AI coding assistants?
The core issue is that AI agents like Claude Code, Copilot, and Codex hold authentication keys and can act without requiring a live human session to authorize actions. This design allows attackers to steal credentials from production systems like GitHub and npm, and the problem cannot be solved through simple patches but requires fundamental architectural changes to how these tools handle permissions.
Why can't individual vulnerability patches fix the security problems in AI coding assistants?
The security issues stem from a common design flaw where AI agents have default permissions rather than requiring explicit user authorization for each action. Without establishing a standard way to anchor each action to a user session, patching individual vulnerabilities will only address symptoms rather than the root cause of credential theft and unauthorized access.
Further Reading
- They Hacked Claude, Gemini, and Copilot (And No One Told You) — Grith.ai
- Claude Code, Gemini CLI, GitHub Copilot Agents Vulnerable to Prompt Injection via Comments — SecurityWeek
- Users Not Warned of Credential Theft in Claude Code, Gemini CLI and GitHub Copilot Agents — ITNerd.blog
- Researchers Hijack AI Coding Agents, Steal Credentials — LetsDataScience
