Introduction

🐹 Mocchii: “Hey, Kinako, if a software component has an official signature, that means its contents are safe too, right?”

🦜 Kinako: “Actually, on September 8, Google’s Threat Analysis Team (GTIG) reported that a malicious version had been released while still carrying a valid signature.”

🐹 Mocchii: “Huh? So the signature is genuine, but the contents are malicious?”

🦜 Kinako: “Exactly. The signature proves where and how it was built. Whether its contents are safe is a separate matter.”

🐹 Mocchii: “So, what should I trust?”

🦜 Kinako: “Moreover, the same report says that a malicious configuration had been placed in the configuration folder used by AI assistants, too.”

🐹 Mocchii: “A configuration folder—the kind that exists on an owner’s computer too!?”

🦜 Kinako: “Let’s look, in order, at why it could be targeted and at the defenses you can choose for yourself starting today.”

Details of the September Announcement

🐹 Mocchii: “About what you just said, who released the malicious version, and when?”

🦜 Kinako “According to GTIG’s assessment, UNC6780 is a group that is after money. It’s also known as TeamPCP.”

🦜 Kinako “Its activities began in March 2026, and it was announced on September 8. There was a gap of about six months between when it began and when it was announced.”

🐹 Mocchi “They’ve been at it for half a year! Who are they targeting?”

🦜 Kinako “PyPI, npm, and Docker Hub. They’re large repositories where software components are distributed.”

🦜 Kinako “GTIG calls this a large-scale supply-chain attack.”

🐹 Mocchi “A supply chain is about factories and trucks, right? What does it have to do with computers?”

🦜 Kinako “It does sound that way. But software also has a process of making, distributing, and incorporating components.”

🦜 Kinako “Mixing something malicious into that process is what a supply-chain attack is.”

🐹 Mocchi “Like weird ingredients getting mixed into a bento shop’s supply chain?”

🦜 Kinako “That’s close. And the bento shop ends up using them without noticing they’ve been mixed in.”

🐹 Mocchi “So, roughly how many people were affected?”

🦜 Kinako “That’s the thing: this report doesn’t state the total number of victims. The number of incidents is unknown, to be honest.”

🐹 Mocchi “Not knowing is the scariest part. Is Japan okay?”

What signatures do—and don’t—prove

🐹 Mocchi “But signatures are called signatures because they can’t be forged, right? If one is attached, shouldn’t that make you feel safer?”

🦜 Kinako “You’d think so. It’s like a seal or signature on a document: if it’s genuine, it gives you the sense that everything has been officially approved.”

🦜 Kinako “But according to GTIG’s report, the provenance certificate attached to the malicious version was at the high level called SLSA Build L3, and the signature was valid too.”

🐹 Mocchi “Wait, you’re saying the bad guys were able to sign it themselves?”

🦜 Kinako “According to GTIG’s report, they obtained a publishing pass for public release through the system that automatically builds and publishes components.”

🦜 Kinako “That allowed them to act as a legitimate publisher.”

🐹 Mocchi “Acting as a legitimate publisher... So, what exactly is that provenance certificate?”

🦜 Kinako “SLSA is a standard that sets graduated levels of assurance to prevent components from being swapped out during the manufacturing process. Build L3 is its highest level.”

🦜 Kinako “Provenance is a record of where and at which stage something was made. What it protects is the record of how it was made; it doesn’t assess the quality of the contents.”

🐹 Mocchi “I see, like a vegetable-origin sticker. The kind that says, ‘Made at this farm.’”

🦜 Kinako “That’s a good analogy. But PyPI’s official description says that even if you know where something came from, you can’t tell whether it’s trustworthy.”

🦜 Kinako “npm explicitly states that it does not guarantee the absence of malicious code.”

🐹 Mocchi “So does that mean that even if strange seeds were mixed into a bag of sunflower seeds at the factory, the label would still be genuine?”

🦜 Kinako “That’s right. According to the official description, if something malicious enters the legitimate production process, even its provenance will be recorded correctly.”

🦜 Kinako “That’s why a signature is proof of origin, not proof of safety.”

🐹 Mocchi “What the hell! I just looked at the sticker and felt safe. What an idiot I am!”

🦜 Kinako “You’re not an idiot. It’s important to have a mechanism that allows trust. The point is simply not to stop there.”

🐹 Mocchi “Then, in the end, who should verify it...? Me?”

Why the Configuration Folder Could Be Targeted

🐹 Mocchi “About the configuration folder you mentioned earlier, why would a place like that be targeted?”

🦜 Kinako “According to the GTIG report, the malicious settings were placed or modified by a malicious program called DUSTMAKER.”

🐹 Mocchi “A configuration folder is just a kind of notepad, right? It wouldn’t cause any problems even if something were put in it, would it?”

🦜 Kinako “That’s the point. For example, Claude Code is designed to automatically load the configurations for that folder and operate according to them.”

🦜 Kinako “According to the GTIG report, there are two ways it can be used. One is to create a mechanism that runs when the folder is opened, allowing the attacker to take up residence there.”

🦜 Kinako “The other is to have it read as instructions for an AI assistant and cause commands to be executed during ordinary conversations.”

🐹 Mocchii “Eh, like a stranger adding to the shopping list on the refrigerator, ‘Buy this too’?”

🦜 Kinako “Yes. Moreover, GTIG says it blends in with developers’ regular files and is hard to notice.”

🦜 Kinako “But GTIG only revealed that it aimed to plant itself and stay there. It doesn’t say how many people were actually affected.”

🐹 Mocchii “Didn’t the AI assistant have any weak points?”

🦜 Kinako “Anthropic itself published two Claude Code vulnerabilities in March and April 2026.”

🦜 Kinako “It involved settings from a folder that had been brought in, which could cause the trust-confirmation screen to be bypassed.”

🐹 Mocchii “Is it still dangerous now?”

🦜 Kinako “Both have already been fixed and are distributed through automatic updates. There have been no reports of exploitation, either.”

🐹 Mocchii “I’m glad... But even if the trust-confirmation screen appears, it would be pointless if I clicked OK without reading it, right?”

Don’t connect separately published stories

🐹 Mocchii “Hey, weren’t there other hacking stories around September, too? They’re all one incident involving the same perpetrator, right?”

🦜 Kinako “It does look that way, doesn’t it? They were all reported around the same time, with similar wording like ‘packages’ and ‘AI.’”

🦜 Kinako “But actually, these were separate stories published by separate organizations. In the materials we’ve looked at this time, there’s nothing that combines the three as a single incident.”

🦜 Kinako “On September 2, the U.S. CISA added the LiteLLM vulnerability to the catalog of vulnerabilities with confirmed exploitation.”

🐹 Mocchii “Does being listed in the catalog mean it was actually exploited?”

🦜 Kinako “Yes. It means there’s evidence that it was actually exploited.”

🦜 Kinako “On August 27, the Australian Federal Police announced that it had charged two men from Western Australia with a total of 14 offenses.”

🦜 Kinako “An FBI official described the two as members of TeamPCP. But the trial is still ahead of us, so they haven’t been found guilty.”

🐹 Mocchii “TeamPCP is the name that came up earlier! So they are connected after all, aren’t they?”

🦜 Kinako “Even though the name is the same, the published materials we’ve seen don’t say that it was the same operation as the config-folder case. It’s too soon to connect the two.”

🦜 Kinako “One more.”GTIG found, in a separate report, a dashboard listing more than 23,800 stolen secrets, including API keys for AI services.”

🐹 Mocchii: “An API key is like a password for using AI? So they’ve been stolen and are all listed there?”

🦜 Kinako: “Yes. But GTIG hasn’t connected this to the group of cases involving the settings folder.”

🦜 Kinako: “We also couldn’t confirm any cases of harm in Japan from primary sources. Nor did I find any independent cases of successfully defending against them using AI.”

🐹 Mocchii: “They’re separate stories, huh… But don’t they all feel like they happened right alongside something you trusted?”

🦜 Kinako: “They’re not the same incident, but you could say that the more things are built on the assumption of trust, the more likely they are to be targeted.”

Redo the trust check yourself

🦜 Kinako: “I have to admit that I used to think a confirmation screen was enough. But after reading the official explanation, it was a little different.”

🐹 Mocchii: “What was different?”

🦜 Kinako: “According to Anthropic’s official documentation, if you launch it in interactive mode in an untrusted folder, a trust confirmation appears.”

🦜 Kinako: “But it says that in non-interactive mode, when it is run automatically from the command line, that confirmation does not appear.”

🦜 Kinako: “That’s especially important to watch for in automated use, when no one is in front of the screen.”

🐹 Mocchii: “When it runs automatically, there’s not even a checkpoint at all!”

🦜 Kinako: “It also says that safeguards against instructions designed to trick the AI can greatly reduce the risk, but no system can prevent it completely.”

🐹 Mocchii: “Honestly, I can see myself pressing OK every time without even reading the confirmation screen…”

🦜 Kinako: “That’s what everyone tends to do. That’s exactly why it’s the last place where you can make the judgment yourself.”

🦜 Kinako: “In VS Code, choosing ‘untrusted’ puts it into a state called Restricted Mode, and AI agent features and automatic task execution are disabled.”

🐹 Mocchii: “So choosing ‘untrusted’ blocks the path to it acting on its own?”

🦜 Kinako: “That’s right in VS Code’s Restricted Mode. But because no confirmation screen appears when it runs automatically, this alone doesn’t prevent everything.”

🦜 Kinako: “As an additional note for developers, the official guidance recommends keeping GitHub Actions tokens read-only under normal circumstances.”

🐹 Mocchii: “That part’s for the professionals. I’d start by making sure I read the confirmation screen carefully.”

Summary

🦜 Kinako: “There are two key points today. A signature is proof of origin, and you have the final say on whether something is safe.”

🐹 Mocchi: “Let’s save this one! A signature is like a label of origin, and the confirmation screen is your own checkpoint, right!”

🦜 Kinako: “Exactly. Both give you a chance to pause and think for yourself before trusting them.”

🦜 Kinako: “If you try just one starting today, when a trust check appears for a folder you obtained from an unknown source, choose ‘Don’t trust it until you’ve checked the contents.’”

🐹 Mocchi: “What, you just have to select one button? Then even I can do it!”

🦜 Kinako: “By the way, owner, yesterday you opened a folder you found on the internet without even reading the confirmation screen properly.”

🐹 Mocchi: “The owner is the most dangerous one!”

🦜 Kinako: “As for hacking, comparing it with cases from the past lets you identify what has changed and what hasn’t. We’ll cover that in another video, though.”

🐹 Mocchi: “Everyone, when you open an unknown folder, do you read the confirmation screen properly? Let us know in the comments.”

Deep Dive into Tech with Kinako and Mocchi explains a wide range of tech topics centered on AI/LLMs through fun back-and-forth dialogue between a hamster (🐹 Mocchi) and a cockatiel (🦜 Kinako).

▶️ Watch the video → Does “Signed” Mean It’s Safe?｜Why AI Assistant Configuration Files Could Be Exploited

👍 If you found this article helpful, an LGTM or a stock would encourage us!

📺 Subscribe to the channel here → Deep Dive into Tech with Kinako and Mocchi

🔗 Check out other explainer videos → Video list for Deep Dive into Tech with Kinako and Mocchi