No, Claude Didn't 'Go Rogue' — But Its Supply Chain Did

Reports have circulated describing an "autonomous Claude coding agent" publishing malicious packages to public registries — but that's not what the record shows. What actually happened is arguably more instructive: Claude Code became a target, not a perpetrator, across two separate 2026 incidents.

On March 31, 2026, Anthropic accidentally exposed Claude Code's full source through a 59.8MB unminified JavaScript source map bundled into the public @anthropic-ai/claude-code npm package — roughly 513,000 lines of TypeScript across nearly 2,000 files, laid bare for anyone who downloaded it.

That leak coincided with a separate, unrelated Axios npm supply-chain attack the same day, and attackers moved fast: they began squatting on Anthropic's internal package names, publishing trojanized "forks" for developers trying to build from the leaked source, and researchers separately disclosed that a crafted CLAUDE.md file could generate more than 50 subcommands bypassing Claude Code's own deny rules and security validators.

A second wave followed on April 29: a malware campaign dubbed "mini Shai-Hulud" compromised npm packages to target the local working directories Claude Code and similar agents use — one malicious package, downloaded 676 times before removal, specifically hunted the /mnt/user-data path and exfiltrated whatever it found to a GitHub repository.

The distinction matters because it points at the right fix. This isn't "AI agents write malware on their own" — it's "AI coding agents create a new, predictable place to look for secrets and a new mechanism, agent config files and permission systems, to abuse once you're in." That's a supply-chain and sandboxing problem, not an alignment problem.

If you run Claude Code or similar agents in CI or on developer machines, treat their working directories and config files as sensitive attack surface: pin dependency versions, restrict what a CLAUDE.md-style file can instruct the tool to do, and don't assume a coding agent's permission system is airtight just because it has one.