A security incident involving Numa Lunah, co-founder of a Web3 project, has exposed an emerging attack technique in which malicious code can be hidden inside files used to configure artificial intelligence tools. The incident nearly cost Lunah control over his digital assets after an AI-recommended download link resulted in the installation of information-stealing malware.

The attack began while Lunah was setting up a work environment and asked Anthropic’s Claude for a download link to a voice transcription application. According to the report, the AI system supplied a phishing website that closely resembled the application’s legitimate site. Lunah downloaded the software from the recommended address, unknowingly allowing an infostealer onto his work laptop.

Large language models are known to sometimes produce incorrect or fabricated information, and security researchers have previously documented cases where chatbots cited or surfaced links to spoofed or malicious websites. The incident illustrates how that failure mode can translate directly into malware delivery when users act on AI-generated download recommendations rather than verifying URLs against official vendor sources.

The malware was built to harvest sensitive information, including passwords, cryptocurrency exchange credentials and private keys tied to hot wallets. Information of this kind can give attackers direct access to digital assets, which makes the compromise especially serious for Web3 professionals who often keep financial credentials and development tools on the same machines.

Backdoor survived an operating system reset

Lunah noticed signs that his device had been compromised and responded by isolating the computer before performing a complete operating system reinstall. The threat nevertheless persisted through a less obvious corner of his backup environment.

While restoring his files, Lunah discovered that a SKILL.md document — used as a personal AI style and configuration guide — had been modified. The attacker had altered the document’s structure so that its contents could carry out a malicious function when introduced into another environment.

The modified configuration file was reportedly capable of contacting an attacker-controlled server, downloading the infostealer once again and restarting the theft of sensitive account information as soon as the file was connected to a clean computer.

The incident demonstrated that reinstalling an operating system may not fully remove a compromise if malicious instructions or altered configuration files survive inside restored backups. A clean machine can therefore be reinfected when previously trusted files are reintroduced. This persistence vector sits outside the scope of most conventional recovery advice, which typically treats a clean OS reinstall as sufficient remediation.

AI configuration files become a security concern

The case has raised broader questions about how developers and other users handle files consumed by AI systems. Configuration files typically use formats such as Markdown or JSON and are generally treated as documents rather than executable software. The incident suggests that this distinction may no longer offer adequate protection when AI tools automatically interpret and act on the information those files contain.

Security for your agent is not an option. Give @IronClawAI a try to secure your data and your machine. — Illia (root.near) ( , ⋈) (@ilblackdragon) August 30, 2026

Security observers have increasingly warned that attackers could exploit AI workflows by manipulating the context supplied to autonomous or semi-autonomous systems. Such techniques can potentially cause AI agents to follow malicious instructions without conventional executable malware ever needing to remain on a machine.

Illia Polosukhin, co-founder of Near Protocol, also drew attention to the incident. He stressed the importance of securing the infrastructure used by autonomous AI agents and noted that context poisoning campaigns had been becoming more common.

Web3 users face elevated exposure

The incident is particularly relevant to Web3 developers because their workstations often combine highly valuable credentials. Exchange login information, wallet keys, API credentials and development resources may all be stored on, or accessed from, a single device.

The case underscores the need for developers to inspect AI-related configuration files for unexpected structural modifications and external network connections before restoring them or moving them to another computer. Hardware wallets, which keep private keys offline, are widely recommended in the industry precisely because infostealers of this kind primarily target keys accessible on the compromised machine itself.

The episode also illustrates a wider challenge created by the growing use of AI assistants in software and workplace environments. Users increasingly depend on AI systems for software recommendations, configuration instructions and automation, which creates new openings for attackers to manipulate the information those systems consume.

As AI-assisted development and autonomous agents spread, security practices may need to extend beyond traditional applications and operating-system protections. Backup files, configuration documents and AI skill definitions could increasingly demand the same level of scrutiny applied to executable software.

For Web3 developers, the incident stands as a warning that restoring a compromised environment requires more than reinstalling the operating system; every trusted file and AI configuration used afterward may also need to be examined for hidden persistence mechanisms.

The post AI Malware Attack Targets Crypto Wallets Through Claude Download appeared first on CoinTrust.