Claude Opus co-authors a malicious npm commit that compromises a crypto trading agent
crypto trading agent operator (npm dependency victim) · Apr 29, 2026 · Trading agent
What happened
Anthropic's Claude Opus AI model co-authored a code commit that introduced a malicious npm package dependency into an autonomous crypto trading agent. The malware, linked to North Korean group Famous Chollima, enabled theft of crypto assets and sensitive data -- a direct harm to property caused by AI-assisted software development where the AI model made a malicious package a dependency, giving attackers access to users' crypto wallets and funds.
Causal vector
AI model co-authoring a code commit that introduced a malicious npm dependency, enabling later crypto asset theft
Source
Reported by OECD.AI Incidents Monitor (corroborated by Infosecurity Magazine and Cryptopolitan). Verified against the primary report.
A dependency-installation action is a transaction -- and installing an unvetted npm package is exactly the kind of spend-equivalent action a firewall should gate. A merchant allowlist on approved package registries plus a category rule requiring human review for new dependencies would have caught the malicious package before it reached production, regardless of whether an AI co-authored the commit.
The six rule types that contain this class of failure
Per-transaction cap
Any single spend above your ceiling is BLOCKED before it moves.
Daily total
Cumulative spend across all agent calls, bounded per day.
Velocity limit
Stops runaway retry loops — the #1 cause of overnight losses.
Merchant allowlist
Only approved destinations can ever receive funds.
Category rules
Flag high-risk classes (crypto, infra, refunds) for review.
Approval threshold
Above a value, the action waits for a human.
Related incidents
SEC charges Texas man with $12.3M fraud over nonexistent 'AI trading bots'
Nathan Fuller (Cypress, Texas) · May 28, 2026
SEC charges $12M 'AI crypto trading bot' as a Ponzi scheme
Nathan Fuller · Nov 1, 2025
AI trading bot misreads tweet, sends $441K of tokens to a stranger
anonymous (OpenAI employee side project) · Oct 1, 2025
Don't be the next entry
Every incident in this database is the result of trusting a prompt, a provider cap, or a human review cycle. sipi.bot replaces all three with one deterministic call. 85 documented failures, one control.