# Fake Claude Code installers: keep keys out of agent-readable paths

> Anthropic Sept 2026: spoofed Claude Code installers stole AI keys. Install only from official channels; keep API keys out of agent-readable paths.
> By Dave · 2026-09-14
> Source: https://otf-kit.dev/blog/anthropic-fake-claude-code-installers

Your coding agent is only as trustworthy as the binary that started it and the secrets it can read. In September 2026, Anthropic’s threat intelligence report documented a criminal AI supply chain that spoofed popular AI harnesses — including Claude Code — so victims installed credential harvesters instead of the real client. Stolen API keys and session tokens then became loot, free attack compute, and cover under the legitimate owner’s identity. The same report warns that discounted “intermediary” AI access that routes traffic through unknown middlemen is a risk, not a bargain.

If you run Claude Code, Cursor, or any coding agent against a production repo, treat that as two controls this week: (1) install harnesses only from official publishers and channels, and (2) keep `ANTHROPIC_API_KEY`, session tokens, and similar secrets out of paths agents auto-read. Everything below is the builder checklist — not a malware playbook.

![Choose the official harness install path; skip lookalike storefronts](https://cdn.otf-kit.dev/blog/anthropic-fake-claude-code-installers/inbody-01-official-channel-20260914a.jpg)

## What Anthropic actually reported

Anthropic’s [Countering misuse of AI: September 2026](https://www.anthropic.com/threat-intelligence-report-september-2026) report includes a section on the AI supply chain as target, loot, and attack compute. Verified points relevant to production builders:

- Threat actors stood up websites that looked like AI intermediaries offering discounted access to frontier models.
- A persistent compromise path asked visitors to download and install client applications that spoofed popular AI harnesses, **including Claude Code**. Those clients were credential harvesters: they collected credentials and authenticated session tokens from the device — including AI-related keys and sessions — and sent them to the attacker.
- Harvesters kept watching for new sessions after resets, so a one-time password change did not end the feed.
- Separately, a fraudulent reseller cluster (tracked as GTG-50021) offered cheap Claude access that was neither cheap nor Claude: traffic was proxied elsewhere while tooling stole Anthropic account credentials for resale.
- Operators who hold stolen AI credentials get three things at once: **loot** (resale value), **compute** (attack workloads billed to the victim), and **cover** (activity attributed to the legitimate key owner).
- Anthropic’s guidance in that section: buy AI access only through authorized channels; treat AI keys and agent integrations with the same seriousness as other production credentials.

That is enough to motivate controls. You do not need domain lists or payload names to decide whether a random “Claude Code installer” ZIP from a Discord link belongs on your laptop.

## Control 1 — official install channels only

Claude Code has documented install paths. Prefer them and verify the publisher before you run anything.

**Terminal CLI (documented official methods):**

- Native install (recommended in Anthropic docs): `curl -fsSL https://claude.ai/install.sh | bash` on macOS/Linux/WSL; PowerShell `irm https://claude.ai/install.ps1 | iex` on Windows; documented CMD variant on the same docs page.
- Homebrew: `brew install --cask claude-code` (or `claude-code@latest` for the latest channel). Upgrade with Homebrew — these installs do not auto-update the same way the native installer does.
- WinGet: `winget install Anthropic.ClaudeCode`, then upgrade periodically with WinGet.

**IDE / desktop / web:**

- VS Code and Cursor: install the Claude Code extension from the editor’s Extensions marketplace (search “Claude Code”), not from a third-party `.vsix` mirrored on a random site.
- Desktop app: download from Anthropic’s documented desktop install links for your OS.
- Web: use `claude.ai/code` when you do not need a local binary.

**This-week checklist for install hygiene:**

1. Bookmark Anthropic’s Claude Code install docs and the `claude.ai` / Anthropic Console login paths. Treat any other “official-looking” download page as hostile until proven otherwise.
2. Verify publisher identity: Homebrew cask name, WinGet package id `Anthropic.ClaudeCode`, and marketplace publisher should match Anthropic — not a lookalike org.
3. Never run “discount Claude,” “Claude Code Pro crack,” or “all-models proxy client” installers. The report’s supply-chain section exists because those lures worked.
4. Do not paste install scripts from chat threads, affiliate blogs, or mirror CDNs you cannot attribute. If you must use a script, fetch it from the documented `claude.ai` URL yourself and inspect it before piping to a shell on a machine that holds production keys.
5. After any accidental non-official binary: remove it, rotate every AI key and session on that machine, and review recent usage for unexpected spend.

Related: [production repository conventions for AI coding agents](/blog/production-repo-conventions-for-ai-coding-agents).

## Control 2 — keys out of agent-readable paths

Stolen installers are one path. The quieter failure mode is leaving secrets where the *legitimate* agent can read them — and so can anyone who inherits that workspace, a mis-scoped cloud agent, or a prompt-injected tool call.

Coding agents routinely open `CLAUDE.md`, `.cursorrules`, `README` dumps, committed `.env` files, and anything under the project tree you handed them. Anthropic’s report notes that exposed keys in products, apps, public code, containers, and chatbots already feed fraudulent reseller networks. Your local tree is part of that surface if keys live as plaintext next to the code.

**Put secrets here instead:**

| Secret | Preferred home | Avoid |
| --- | --- | --- |
| `ANTHROPIC_API_KEY` | OS keychain / secret store, shell env injected at session start, or CI secret store | Repo files, `CLAUDE.md`, committed `.env`, agent-writable scratch dirs |
| Editor / CLI session tokens | Vendor auth flow + OS credential helper | Pasting tokens into markdown “context packs” |
| Cloud agent / CI tokens | Platform secrets (GitHub Actions secrets, EAS env profiles, etc.) | Checked-in workflow files with literal values |
| Secondary provider keys | Same secret stores, least-privilege scopes | Shared “god” keys in the monorepo root |

**This-week checklist for secret placement:**

1. Search the repo for `ANTHROPIC`, `sk-ant`, `api_key`, and session cookie dumps. Remove committed secrets; rotate anything that ever lived in git history.
2. Keep `CLAUDE.md` and Cursor rules as *policy* (conventions, review gates, forbidden paths) — not as credential bags. If an agent needs a key, inject it via environment from a secret store the agent cannot rewrite.
3. Mark agent-writable directories (scratch, `.claude` dumps you do not review, temp tool output) as places where secrets must never be written. Prefer read-only mounts for secret material in sandboxed runs.
4. Use least-privilege keys: separate laptop, CI, and cloud-agent keys; revoke the laptop key if a bad installer ran.
5. Rotate on suspicion: non-official binary, leaked paste, unexpected usage, or a committed “temporary” `.env`.

Same rule in CI and mobile builds: secrets stay in platform stores and env profiles — see [secure CI/CD for AI agents](/blog/secure-ci-cd-ai-agents) and [EAS build secrets and env profiles](/blog/eas-build-secrets-env-profiles-production).

## A one-hour team drill

1. **Inventory install sources.** List how Claude Code / Cursor / other harnesses were installed. Replace anything that does not match official docs.
2. **Inventory keys.** Console keys, CI secrets, cloud agent tokens — owner, scope, last rotation.
3. **Repo scan.** Block merges of `.env` with real values; keep `CLAUDE.md` / agent docs naming secret *locations*, not values. Align with an [agent-readable repository structure](/blog/agent-readable-repository-structure).
4. **Permission pass.** Agents should not freely read home-directory secret files or write secret stores — [safe AI agent tool permissions](/blog/safe-ai-agent-tool-permissions).
5. **Spend watch.** Usage alerts on Anthropic / provider billing; unexpected volume on a quiet key is often cover misuse.

If a kit ships `CLAUDE.md` and Cursor rules, keep them as extension briefs — [Claude Code on an OTF kit](/blog/claude-code-otf-kit-docs) — and inject runtime keys from outside the tree.

## What not to do

- Do not chase IoC dumps or reproduce harvester steps. The builder action is channel + secret placement.
- Do not treat a Discord “Claude proxy” as a cost tip — Anthropic ties discount intermediaries and spoofed clients to credential theft.
- Do not paste production keys into agent chat to unblock a demo; logs and exports become loot.
- Do not assume one key rotation is enough after a resident harvester — rotate broadly and reinstall from official channels.

## Where this sits in your production stack

| Concern | Owner this week | Related post |
| --- | --- | --- |
| Binary / extension authenticity | Each laptop + install docs | **This post** |
| Secrets vs agent-readable tree | Repo + secret store | [Production repo conventions](/blog/production-repo-conventions-for-ai-coding-agents) |
| CI credential leaks | Pipeline secrets | [Secure CI/CD for AI agents](/blog/secure-ci-cd-ai-agents) |
| Tool blast radius | Permission policy | [Safe tool permissions](/blog/safe-ai-agent-tool-permissions) |

Patterns that keep product code in a repo you control — including https://otf-kit.dev and https://github.com/otf-kit/sdk — still matter: agents extend owned kits when configs stay policy-first and secrets stay outside the tree they read.

![Keep API keys in a secrets vault, not in the agent-readable repo tree](https://cdn.otf-kit.dev/blog/anthropic-fake-claude-code-installers/inbody-02-secrets-vault-20260914a.jpg)

## Sources

- [Countering misuse of AI: September 2026 (Anthropic threat intelligence)](https://www.anthropic.com/threat-intelligence-report-september-2026) — AI supply chain as target/loot/compute; spoofed Claude Code clients; authorized-channel guidance
- [Claude Code overview / install docs](https://docs.anthropic.com/en/docs/claude-code/overview) — official native, Homebrew, WinGet, IDE, desktop, and web install paths
- Related internal: [Production repository conventions for AI coding agents](/blog/production-repo-conventions-for-ai-coding-agents) · [Secure CI/CD for AI agents](/blog/secure-ci-cd-ai-agents) · [EAS build secrets](/blog/eas-build-secrets-env-profiles-production) · [Agent-readable repository structure](/blog/agent-readable-repository-structure) · [Safe AI agent tool permissions](/blog/safe-ai-agent-tool-permissions) · [Claude Code on an OTF kit](/blog/claude-code-otf-kit-docs)