An engineer went looking for an AI programming tool. The download they obtained was a tampered installer. Months later, attackers were moving through colleagues’ computers with the help of an internal AI tool and stolen credentials.
That is the opening of Binance’s preliminary account of its October 29 theft. For anyone drawn to the speed of vibe coding, the uncomfortable question arrives before the first generated function: what have you just allowed to run, and what can it reach?
Futurism’s November 5 report frames the roughly $6.3 billion heist around employees’ use of AI coding tools. The evidence supports a cautionary tale about trust in the surrounding workflow. Binance’s public account does not demonstrate that AI-generated wallet code caused the theft.
Vibe coding usually means directing a model in ordinary language and accepting its implementation with limited attention to the code underneath. The appeal is a short journey from an idea to something that works. The risk comes when that short journey also skips scrutiny of downloads, unfamiliar repositories, credentials and production access.
A shortcut into the development environment
Binance says the June 2026 download was a modified Homebrew installer sought by a wallet DevOps engineer. Security staff replaced the device and renewed credentials, but the attackers had learned about wallet-team workstations.
In September, a fake recruitment process persuaded another engineer to run a technical-test repository on a work computer. Malicious code executed during setup. On October 20, attackers used that compromised machine and an internal AI tool to control two wallet engineers’ computers. Stolen deployment credentials later helped them reach wallet operations.
The company says it rebuilt the affected wallet environment and internal AI tool, strengthened access controls, replaced devices and deactivated associated credentials. It leaves the AI tools unnamed.
The installer risk has independent technical context. A May 1 investigation by the SANS Internet Storm Center documented a search advertisement leading to a fake Homebrew page that distributed MacSync Stealer. That investigation illustrates the impersonation mechanism. It does not independently reconstruct the Binance intrusion.
Homebrew’s official site supplies the legitimate installation routes. The familiar tool name on an advertisement or a copied command supplies no assurance that the download came from that project.
Attackers have their own coding assistants
There are also documented cases in which the model helped the attacker build or conduct an operation. These examples are historical context for the current Binance disclosure, with different roles for AI in each case.
Data theft and extortion, August 2025. In its August threat report , Anthropic described a criminal targeting at least 17 organizations with Claude Code. The reported work included reconnaissance, credential theft, network intrusion and analysis of stolen data for extortion. The company said the model also helped decide what information to take and how to formulate demands. Here, the coding assistant supported an attack workflow well beyond writing a deceptive email.
Ransomware development, the same report. Anthropic separately described a seller using Claude to develop and distribute ransomware variants advertised for $400 to $1,200. It assessed the operator as dependent on AI for implementing and troubleshooting important components. That is a concrete example of AI filling technical gaps. The report does not establish how often inexperienced criminals achieve comparable results or how many buyers successfully infected victims.
A single operator’s political targets, spring 2026. Anthropic’s September 2026 report describes a French-speaking actor using Claude against European political parties, media, think tanks and their service providers. The company says the actor used agentic coding to coordinate sub-agents and developed and debugged an exploit in the same session. It reports success against at least four websites and, in one platform compromise, theft of approximately 140,000 records containing political opinions. The software-development loop had become part of an intrusion operation.
Malware asking a model what to run, June 2025. Google Threat Intelligence Group’s November 2025 investigation describes PROMPTSTEAL, attributed to Russia-backed APT28 and used against Ukraine. It queried Qwen2.5-Coder-32B-Instruct through Hugging Face to generate commands for collecting system information and documents, then executed the output. This is runtime use of a model inside malware, a different mechanism from an attacker asking an assistant to write code beforehand.
The Anthropic cases are the provider’s investigations of activity it could observe, rather than independent replications. Google’s report supplies a separate technical investigation. Together, these records establish specific forms of misuse without measuring the share of cybercrime that involves AI.
Ask where the trust changes
The cases become easier to act on when the role of the tool is explicit.
| Where AI enters | What the evidence shows | The defensive question |
|---|---|---|
| A developer’s installation workflow | Binance describes a tampered installer sought for an AI tool | Who supplied the executable? |
| An attacker’s development loop | Anthropic describes coding help for extortion and ransomware | Can the organization detect the resulting intrusion? |
| Malware already running on a victim | Google describes model-generated commands executed by PROMPTSTEAL | What can that process read, run and send? |
A model’s refusal policy addresses the assistance it will provide. A workstation’s permissions address what an installed process can do. A company’s deployment controls address whether access to one engineer’s machine can become authority over production. Each needs enforcement at its own point.
For developers, the practical response starts before the first prompt. Obtain tools through verified official distribution routes. Treat an unfamiliar repository, including a recruitment exercise, as executable material. Use a disposable environment without work credentials for an untrusted coding test. Keep production tokens out of experimental workspaces and give agents only the files, network destinations and services their assignment requires.
That follows NIST’s principle of least privilege . Anthropic’s sandboxing explanation similarly distinguishes filesystem restrictions from network restrictions. A useful boundary must account for both access to sensitive material and a route to send it away. The exact protection depends on the configuration actually enforced.
A working result still needs a security decision
The same caution applies to the code an agent produces. Review changes, dependencies and installation behavior. Retain checks that can reject an insecure implementation, including authorization failures. Separate the ability to propose or test a change from the ability to release it.
Newsroom’s AI engineering review framework develops that distinction through a concrete software-repair example. Its PHP and LiteLLM analysis examines another related failure: an exposed credential surviving long enough to compromise software delivery.
A prototype working on screen can make the next click feel routine. Binance’s account is a reason to pause at precisely that moment. Verify the download, understand what setup will execute, limit the credentials in reach and keep release authority separate. The time saved by a coding assistant is useful only if the shortcut preserves those decisions.
