Tip: Using Claude for Real-Time Security Incident Triage — Minute-by-Minute LiteLLM Malware Analysis

Simon Willison·medium signal

Callum McMahon published a minute-by-minute transcript (highlighted by Simon Willison on March 26) showing how Claude helped him identify malicious code in the backdoored LiteLLM PyPI package during the active incident, including recognizing the base64-encoded payload, tracing the exfiltration targets (SSH keys, cloud credentials), and deciding how to report to security contacts. The post demonstrates a concrete pattern for using coding agents as real-time security analysis tools — feed suspicious code to Claude, have it trace the attack chain, and use its analysis to inform your incident response. Faster than manual reverse engineering by an order of magnitude.