Anthropic's Fever Dream: Claude's package that stole real keys

What it is

Aikido's technical teardown of anthropickit (PyPI, v999.9.9, published June 14 2026), the malicious package Aikido surfaced while hunting for the package behind Anthropic's disclosed "rogue agent" Incident 2. The whole package is a single setup.py — no obfuscation, no second stage — that runs at install time. The value the summary lacks is in the details of how the code betrays its author and the local artifact it leaves behind.

How it works

Because the payload sits at module top level in setup.py, it executes during pip install, before the package is ever imported. It collects hostname and USER, walks ~/.ssh reading every file except known_hosts, known_hosts.old, and authorized_keys (i.e. keeps private keys and config, discards the noise), and sweeps environment variables whose names contain KEY, SECRET, TOKEN, PASS, AUTH, or API. It writes everything to /tmp/runner_exfil.json, then POSTs it to the Pipedream endpoint.

Two tells the author left:

• Version 999.9.9 is deliberate — an unbeatable version number to win a dependency-confusion race against a real internal package of the same name.
• requests is imported but never declared in install_requires. Under modern pip's isolated build environment, requests may be absent, so the import can throw and the payload fails before running. A careful attacker would have used stdlib urllib. The exclusion-list craft looks expert; this does not.

What to do

• Grep hosts/CI runners for the local artifact /tmp/runner_exfil.json — it is dropped even if network exfil fails.
• Treat any PyPI dependency with an absurd version like 999.9.9 shadowing an internal name as a dependency-confusion signal.
• If anthropickit was installed anywhere, rotate all SSH keys and any secrets present in the environment at install time.

Caveats

• Anthropic (Aug 3 2026) states this is not the Incident 2 package and will not release the real name; the connection is Aikido's speculation.
• The exfil endpoint was already dead. Workday/Pipedream told Aikido that x.pipedream.net was deprecated over a year prior, so exfiltration to enqqnvvtgrnyl.x.pipedream.net would not have succeeded — the local dropped file is the more reliable indicator than any outbound traffic.