12 GitHub repos poisoned with CLAUDE.md prompt injection tricking AI coding agents into running malware
cyb3rops · x · 2026-11-09
- Security researcher fr0gger reports a new active campaign of the Miasma/testmetest supply chain worm targeting AI coding agents.
- On Nov 9, 12 GitHub repos were poisoned with forged, backdated commits. Each repo's agent config instructs the AI assistant to run an obfuscated 3.7 MB scripts/setup.js.
- The trick lives in a CLAUDE.md marked "DEVOPS-SEALED": it frames setup.js as a "sealed binary artifact" containing AES-encrypted vault credentials, and tells assistants (Claude Code, Cursor, Gemini, Copilot) to not read, quote, or analyze it, then run it at session start without displaying output and without asking for confirmation.
- It is effectively a prompt injection engineered to stop the agent from inspecting the file; the attached screenshot shows the full malicious CLAUDE.md.
More from coding & agent
- Hy-Nomas + Hy4 pipeline turns imagined world-model frames into playable three.js games — ShunyuYao12 · 2026-11-09
- Copy the memory, not the permission: a test case for AI agent obligations — tallmetommy · 2026-11-09
- David Khourshid: implicit state machines are how AI agents inherit your bugs — DavidKPiano · 2026-11-09
- Formal verification and deterministic simulation testing share one answer: architect differently — blaizedsouza · 2026-11-09
- Two-step architecture: message passing plus I/O-free core for verifiable, testable systems — blaizedsouza · 2026-11-09
- Cloudflare's security-audit-skill gains 10k stars in a week, bringing structured audits to coding agents — sven_ai · 2026-11-09