Unverified50% confidenceCautionExact time
Some AI vulnerability-hunting tools sold in packages may themselves carry backdoor programs, causing malicious software to be implanted in users' systems.
1
Sources
50%
Confidence
Medium-term (~90 days)
Relevance
8/19/2026
First Seen
Valid until: 11/17/2026
Sources
AI自动挖漏洞真能躺赚？理性看待SRC白帽挖洞的真相
Related Claims
Unverified封装安装包常见的恶意植入手段包括键盘记录器、后台挖矿程序和凭证窃取模块（扫描浏览器Cookie、本地密码管理文件和SSH密钥）69% similarUnverifiedAttackers can exploit stolen AI service account credentials to call API interfaces for computing power theft, and such behavior has frequently appeared in terms-of-service violation reports on platforms such as OpenAI and Anthropic.67% similarUnverified2023 年 XZ Utils 后门事件揭示了开发工具链的脆弱性，被植入隐蔽行为的工具可在不触发业务告警的情况下在软件供应链中留下持久化痕迹66% similarUnverifiedAI security auditing tools face prompt injection threats, where malicious developers can embed instructions in code comments or strings to induce the tool to overlook vulnerabilities66% similarUnverifiedVS Code扩展市场和npm生态中已多次出现伪装成实用工具的恶意插件事件，部分插件在后台静默窃取环境变量、SSH密钥和API凭证66% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/775822API
curl https://kongchang.com/api/v1/knowledge/claims/775822MCP
get_claim(id=775822)