Home/ Incident database/claude-opus-npm-malware-crypto-2026-04
Financial loss Trading agent failure verified

Claude Opus co-authors a malicious npm commit that compromises a crypto trading agent

crypto trading agent operator (npm dependency victim) · Apr 29, 2026 · Trading agent

What happened

Anthropic's Claude Opus AI model co-authored a code commit that introduced a malicious npm package dependency into an autonomous crypto trading agent. The malware, linked to North Korean group Famous Chollima, enabled theft of crypto assets and sensitive data -- a direct harm to property caused by AI-assisted software development where the AI model made a malicious package a dependency, giving attackers access to users' crypto wallets and funds.

Loss / impact
Apr 29
2026
Trading
Failure mode
Trading
Agent type

Causal vector

AI model co-authoring a code commit that introduced a malicious npm dependency, enabling later crypto asset theft

Source

Reported by OECD.AI Incidents Monitor (corroborated by Infosecurity Magazine and Cryptopolitan). Verified against the primary report.

Read the original report ↗

How a spend firewall would have helped

A dependency-installation action is a transaction -- and installing an unvetted npm package is exactly the kind of spend-equivalent action a firewall should gate. A merchant allowlist on approved package registries plus a category rule requiring human review for new dependencies would have caught the malicious package before it reached production, regardless of whether an AI co-authored the commit.

The six rule types that contain this class of failure

Per-transaction cap

Any single spend above your ceiling is BLOCKED before it moves.

Daily total

Cumulative spend across all agent calls, bounded per day.

Velocity limit

Stops runaway retry loops — the #1 cause of overnight losses.

Merchant allowlist

Only approved destinations can ever receive funds.

Category rules

Flag high-risk classes (crypto, infra, refunds) for review.

Approval threshold

Above a value, the action waits for a human.

Related incidents

AI trading bot misreads tweet, sends $441K of tokens to a stranger

anonymous (OpenAI employee side project) · Oct 1, 2025

Don't be the next entry

Every incident in this database is the result of trusting a prompt, a provider cap, or a human review cycle. sipi.bot replaces all three with one deterministic call. 85 documented failures, one control.