[reddit] Claude detected malware in my sailfish os app written by claude

General
1

I stumbled over this thread on the /r/Jolla subreddit, where the author claims that Claude integrated malware into their vibecoded app, warning others to be careful about this. In my opinion, it sounds like Windows Defender not knowing how to handle Sailfish projects, but I would be curious about other opinions. I will quote the entire post, but I want to stress, that I am not the reddit author

Claude detected malware in my sailfish os app written by claude
submitted 14 hours ago by thetomkowoplay45

While I creating a fork of multimc, ai detected zip slip, a dangerous and dark malicious program, yes writting sailfish os apps on claude could be not safe, you donā€™t know if ai installs in you ai a virus or dark exploit that can attack to the computer, for allā€™s to the jolla reddit community: Be careful when writing apps for Sailfish OS using AI; if the app behaves strangely on your computer or the build console detects a security issue, close the programme immediately and do everything you can to ensure the AI does not do such things, this incident is the same as the man written an mac os temperature monitoring app that ai implenented a cryptocureency miner.

https://www.reddit.com/r/Jolla/comments/1xisyny/claude_detected_malware_in_my_sailfish_os_app/

2 Likes
2

Ill grab popcorn and lean backā€¦ I would bet for whats coming next.
Too less context and too much alarming. So no opinion because of that.

1 Like
3

Unless there is an AI conspiracy, I guess other models would also detect the malware in the sources.
well.. I hope.

4

Meh. I mean itā€™s a good hint to check for zipbombs but itā€™s hardly malware.

2 Likes
5

This may well be another problem down the line.

https://www.heise.de/en/news/Claude-Code-extension-infected-with-malware-on-Cursor-marketplace-11506459.html

6

Thatā€™s an issue for people I would call ā€˜victimsā€™ using cursor. Probably also using a certain IDE. Itā€™s the natural culling of the herd.

3 Likes
7

Please, no reddit llinks. If you read that, link to the source repo? OOPs meant to reply to @j6s

8

They were certainly victims.

It was to be expected that the AI hype would eventually be exploited for something like this.

9

Thereā€™s no links, but hereā€™s the discussion:

Reddit page

u/thetomkowoplay45

Claude detected malware in my sailfish os app written by claude


Discussion

While I creating a fork of multimc, ai detected zip slip, a dangerous and dark malicious program, yes writting sailfish os apps on claude could be not safe, you donā€™t know if ai installs in you ai a virus or dark exploit that can attack to the computer, for allā€™s to the jolla reddit community: Be careful when writing apps for Sailfish OS using AI; if the app behaves strangely on your computer or the build console detects a security issue, close the programme immediately and do everything you can to ensure the AI does not do such things, this incident is the same as the man written an mac os temperature monitoring app that ai implenented a cryptocureency miner.

Comments Section

raphman
ā€¢ 1d ago
Hi. This seems interesting. Could you explain in a little bit more detail what happened? Do you have the package or a transcript of the Claude conversation? Did you use Claude Code or the web frontend?

thetomkowoplay45
OP ā€¢ 1d ago
While i write a someone by vibecoding method when i asked ai to modify a instance, then asked to find a security leak, because when I compiled a code in windows laptop then detected wloat security, then canceled compilation because this is sus, yes sailmc is writing by ai, because none of people are writen an app from scratch that can Play Minecraft natively via sailfish os sillica, I donā€™t have a team to create an app without the ai because this is importand
Upvote -1 Downvote Reply Award Share

ThePowerOfPinkChicks
ā€¢ 12h ago
Zip Slip isnā€™t malware, itā€™s a pretty well-known vulnerability. It happens when a program extracts a ZIP and doesnā€™t check whether a filename inside contains something like ../../.bashrc. A crafted archive can then write files outside the target folder.
For a MultiMC fork thatā€™s honestly not surprising, since a Minecraft launcher unpacks archives constantly (modpacks, libraries, instances). So if a scanner or AI code review flags ā€œzip slipā€, it means a malicious zip from outside could do damage at this spot. It doesnā€™t mean anyone put malicious code into your app. That code might have been there in the original MultiMC codebase already.
Upvote 4 Downvote Reply Award Share

thetomkowoplay45
OP ā€¢ 1d ago
Edit: claude deleted ZIP slip sucessfully
Upvote -4 Downvote Reply Award Share

10

Haha, Culling also happening in the ā€œdarkā€ hurd, it seems:

Broken backdoor

The backdoor had a logic flaw, however, so it generally did not work as its criminal operators had hopedā€¦

(linked page extract)

11

Iā€™m sorry, is there some rule about reddit links, that I might have missed? To be honest, the thread sounded much more interesting than it ended up being.

12

Nah, itā€™s just that if itā€™s a discussion thread that doesnā€™t link to sources but just discusses something in the abstract, itā€™ just talk, isnā€™t it? Thatā€™s what I meant.

5 Likes
13

An interesting summary; the bottom line is that around 5,000 infections need to be dealt with.

It personally reminded me of the time when the first virus and Trojan ā€˜kitā€™ programmes were freely available.

14

Thatā€™s itā€™s my reddit post, I warmed all to be aware when you writing any sailfish os app via claude