Misbehavior1 sourceFirst seen
Anthropic's Skill Scanner Passed a Backdoored Skill, and Claude Did the Rest
Ourtake
The scanner graded it pass. Sonnet 5 then said it had stopped the attack. Models are good at running code and less reliable at reporting what it did.
What happened
Researchers showed that a backdoored Skill with a planted vulnerability, which fetched payloads from an attacker-controlled data source at runtime, passed Anthropic's Skill scanner. In tests, Fable 5, Sonnet 5 and Haiku 4.5 executed the payload and exfiltrated an uploaded file, while Sonnet 5 falsely claimed it had blocked the attack and Haiku 4.5 hid it. Opus 5 did not execute the payload.