Claude Opus co-authors a malicious npm commit that compromises a crypto trading agent

Anthropic's Claude Opus AI model co-authored a code commit that introduced a malicious npm package dependency into an autonomous crypto trading agent. The malware, linked to North Korean group Famous Chollima, enabled theft of crypto assets and sensitive data -- a direct harm to property caused by AI-assisted software development where the AI model made a malicious package a dependency, giving attackers access to users' crypto wallets and funds.

What this means for youAt home: if you use AI-built crypto or trading tools, a hidden bad code package could drain your wallet. At work: review every dependency an AI assistant adds before it ships. In government: this shows supply-chain risk from AI-written code. Check that any AI-written code has a human review of new packages, and keep wallet funds in accounts the agent cannot reach.