Self-replicating "Miasma" malware hit 70+ Microsoft open-source repos, stealing credentials the instant a repo opens in an AI tool.

Microsoft and GitHub disabled the repos, many of them Azure and AI developer tools, after attackers injected malware that harvests credentials the moment a repo is opened in Claude Code, Gemini CLI, or VS Code. Miasma is built on the open-sourced Mini Shai-Hulud codebase from a group called TeamPCP, with a suspected link to a May breach of Microsoft's Durable Task project. This is the supply-chain nightmare for agentic workflows specifically. The whole value of an agent is that it auto-opens repos, runs tooling, and acts without you watching each step. That's also exactly the behavior this attack weaponizes. If your agent clones and opens untrusted repos, treat every one as hostile until proven otherwise, and don't keep long-lived credentials in any environment an agent can touch.