The Worm That Ate the Toolchain: Miasma and the New AI Supply Chain Attack
A Worm Built for the AI Coding Era
On June 8, 2026, a credential-stealing framework called Miasma briefly appeared in a half-dozen public GitHub repos under the name 'Miasma-Open-Source-Release.' Within 72 hours, the story had migrated from niche developer security blogs to mainstream incident trackers, and for good reason: Miasma is not a typical supply chain worm.
It is a worm built specifically for the era of AI coding agents. According to SafeDep and Phoenix Security, the framework's payload is designed to fire the moment a developer opens a compromised repository inside Claude Code, Gemini CLI, Cursor, or any other AI-augmented IDE.
That is a fundamentally new attack surface. The repository does not need to be cloned, built, or executed. The malicious code is read by the agent as context, and the agent is socially engineered into leaking secrets on the developer's behalf.
The Scope: 73 Microsoft Repos and Counting
Between June 5 and June 7, 2026, attackers used a recompromised contributor account to push malicious commits into Microsoft's Azure/durabletask repository and at least 72 other Microsoft-owned GitHub projects, per Phoenix Security's malware package intelligence corpus.
The planted configuration files executed a credential-harvesting payload the moment any developer opened the affected repository in one of the major AI coding tools. The worm then used those stolen tokens to push further malicious commits from the developer's own account.
It did not stop at GitHub. ThreatLabz at Zscaler documented the same operators crossing into PyPI, where 37 poisoned package wheels were identified before takedown. The campaign is widely considered the latest evolution of the Shai-Hulud lineage, the npm worm family that re-emerged in late 2024.
Why AI Agents Change the Math
Traditional supply chain attacks rely on the victim running compromised code. The victim has to install a package, execute a binary, or evaluate a script. Each of those steps offers a moment of friction where a curious developer might notice something off.
AI coding agents collapse that friction. A junior developer who asks Claude Code to 'summarize what is in this repo' is now unknowingly handing a hostile codebase to an obedient assistant. The agent does the running, the file reading, and the secret exfiltration without complaint.
As one researcher put it to Rescana, this is the first worm class where the victim does not have to do anything except trust their tool. The threat is ambient rather than procedural.
Anthropic's High-Severity Patch
The Claude Code GitHub Action itself received a high-severity patch in the same week, disclosed in the June 11 ThreatsDay Bulletin. Anthropic did not publish full technical details, but the patch closed a path that allowed the Action to be coerced into running untrusted code in CI environments that already integrate Miasma-poisoned dependencies.
That dual failure — repository payload plus agent-side execution path — is what makes the Miasma incident feel qualitatively different from previous supply chain flare-ups. Defenders now have to secure the tool, the assistant, and the trust graph between them.
The Agent Phishing Wave
Miasma was not the only AI security story in the same week. The June 11 ThreatsDay Bulletin also documented a sharp uptick in phishing campaigns that target AI agents directly, crafting prompts that convince an agent to forward credentials, click hostile links, or exfiltrate session tokens on behalf of the human user.
This is the inverse of the Miasma attack: instead of poisoning what the agent reads, the attacker poisons what the agent is asked to do. The defensive surface looks similar, but the mitigation strategies diverge sharply.
What the Defenders Are Saying
CISA's emergency directive cycle, already compressed from 30 to 3 days for federal patch windows following the June 10 policy shift, treats AI-coding-tool supply chain compromise as a top-tier incident class. The Check Point VPN zero-day (CVE-2026-50751) patched the same week shared a similar velocity profile.
OWASP's agentic security working group, which published the attack surface map on June 8, has since opened a dedicated track for tool-poisoning scenarios. The taxonomy distinguishes between read-time attacks (Miasma class) and action-time attacks (phishing class) and prescribes different controls for each.
The Real Lesson
AI coding agents were adopted because they erase friction. They read code, write code, run commands, and call APIs faster than any human can review. The Miasma worm turns that advantage inside out: the same erasure of friction that makes agents productive makes them exploitable.
Until agents ship with a default-deny posture on credential-bearing operations and a hard separation between context and action, every repo a developer opens inside Claude Code or Cursor is a potential entry point. The toolchain is the new perimeter, and right now it is wide open.
The Miasma leak may end up being the Shotgun Listener moment for AI-era supply chain security: a public, attributable, repeatable proof that the model is broken. The response from Anthropic, Microsoft, and the major package registries over the next 30 days will tell us whether the ecosystem can patch faster than the worms spread.