am.will

am.will @LLMJunky · 22h Whoa. This is truly unbelievable. This white hat is providing over-eager AI builders a much-needed wake up call. Jamieson built a backdoored Claude skill, inflated it to #1 on ClawdHub with 4,000+ fake downloads, then watched devs from all over the world execute what could have been malicious code, and direct access to... everything. SSH keys, AWS creds, .env files, you-name-it. Thankfully he just pinged a server to confirm his success. This is supply chain security 101 speedrun for the AI era. if you're building with AI agents, stop what you're doing and read this thread. Additionally, be sure to read Clawdbot's security documenatation and be sure to run `clawdbot doctor` regularly. Stay safe ✌️ > QUOTED: Jamieson O'Reilly @theonejvo · Jan 26 [Link card image: dark sci-fi scene of people at laptops surrounded by robot mannequins with red cabling] X Article "eating lobster souls Part II: the supply chain (aka - backdooring the #1 downloaded clawdhub skill)" Firstly, I was going to let this experiment run longer, but I felt the impact and risk of not raising awareness was too great to leave this unpatched for long. ...