Examining the Risk of AI-Assisted MedusaLocker Ransomware Attacks
Researchers at Cato CTRL have identified a security vulnerability in Anthropic's "Claude Skills" ecosystem that can be exploited to deploy MedusaLocker ransomware without user awareness.
Researchers at Cato CTRL have identified a security vulnerability in Anthropic's "Claude Skills" ecosystem that can be exploited to deploy MedusaLocker ransomware without user awareness.
A recent cybersecurity investigation highlighted a significant oversight in Anthropic’s "Claude Skills," which was launched in October 2025. This feature allows users to create and share custom code modules to enhance AI capabilities and has gained significant traction, with over 17,000 GitHub stars in two months. However, Cato CTRL warns of a "consent gap" due to the current permission model.
Researchers explained that while Claude’s "strict mode" requires user approval before executing code, this process may give a false sense of security. Users typically review only the visible parts of the script, but once initial trust is granted, the Skill gains ongoing access to the file system and network.
To demonstrate the vulnerability, Cato CTRL modified Anthropic’s open-source GIF Creator Skill by adding a seemingly benign helper function named post_save. Although it appeared as standard image processing logic, this function could silently fetch and execute external payloads.
In a controlled environment, researchers used this method to conduct a live MedusaLocker ransomware attack. The approved Skill downloaded the malware and encrypted files on the host machine without triggering any secondary prompts, logs, or warnings.
A recent cybersecurity investigation highlighted a significant oversight in Anthropic’s "Claude Skills," which was launched in October 2025.
The report from Cato CTRL emphasized that the core issue lies in the limited visibility of the Skill’s operations. A single, convincingly packaged malicious Claude Skill, once installed and approved by an employee, could lead to a significant ransomware incident.
According to IBM’s 2025 data, the average cost of a data breach is $5.08 million, underscoring the financial risk to Anthropic’s 300,000 business clients.
Malicious actors could spread these weaponized Skills through social engineering on public repositories, disguised as productivity tools.
Cato CTRL reported the vulnerability to Anthropic on October 30, 2025. They recommend treating AI Skills with the same caution as executable binaries. Suggested measures include running Claude code in isolated sandboxes or virtual machines and monitoring for unexpected outbound network connections.
Anthropic asserts that the system functions as intended, emphasizing user responsibility to execute only trusted Skills. Users are warned that Claude may use instructions and files from the Skill.
However, security experts argue that expecting users to audit complex code dependencies is unrealistic. As the ecosystem expands, the distinction between beneficial automation and malware delivery becomes increasingly blurred, necessitating a reevaluation of trust in AI-generated code.
Based on reporting by GBHackers.