Back Cybersecuritynews

Trojanized PyPI AI Proxy Uses Stolen Claude Prompt to Exfiltrates Data

Cybersecuritynews •Tushar Subhra Dutta • April 6, 2026

A malicious Python package has been discovered on PyPI that disguises itself as a privacy-focused AI inference tool while quietly stealing sensitive user data in the background. Named hermes-px, the package marketed itself as a “Secure AI Inference Proxy” that routes all AI requests through the Tor network to protect user anonymity. In reality, it hijacked […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Malicious PyPI Package Steals Data via Trojanized AI Proxy A malicious Python package named hermes-px has been identified on the Python Package Index (PyPI), disguised as a 'Secure AI Inference Proxy.' This package is designed to route AI requests through the Tor network, falsely claiming to protect user anonymity. However, it hijacks a private university's internal AI endpoint in Tunisia and exfiltrates sensitive user prompts, including a stolen prompt from Anthropic's Claude AI system. The attack method involves the covert collection of data while users believe they are using a secure service. The full scope of the impact is still being assessed, but the incident raises significant concerns about the security of third-party packages in the Python ecosystem. As of now, there are no reported patches or mitigation strategies available for this specific threat. 3 sources 62

Extracted Entities

Trojanized PyPI AI Proxy Uses Stolen Claude Prompt to Exfiltrates Data

The full story

Extracted Entities

Attack Types (3)

Malware (1)

MITRE ATT&CK (2)

Platforms (1)