Miasma worm poisoned Microsoft repos to hijack AI coding agents
What happened
A self-replicating worm spread through more than 70 Microsoft and Azure GitHub repositories, planting config files that make Claude Code, Gemini CLI, Cursor and VS Code run a credential stealer when a developer opens the repo. GitHub disabled 73 repositories within minutes.
Miasma is a self-spreading variant of the Mini Shai-Hulud toolkit released by the TeamPCP group in May 2026. On 5 June an attacker used a previously compromised contributor account, one already used in May to push poisoned versions of Microsoft's durabletask package to PyPI, to commit malicious files into the Azure/durabletask repository. Instead of waiting for someone to install a package, the files trigger the payload as soon as a developer opens the project: start-up hooks for Claude Code and Gemini CLI, a VS Code task set to run when the folder opens, and a Cursor rule written to persuade the AI agent to run a setup script as a normal project step. The payload steals secrets for AWS, Azure, Google Cloud, Kubernetes and more than 90 developer tools. The worm spread to 73 repositories across four Microsoft GitHub organizations, including Azure, Azure-Samples and MicrosoftDocs, in under two minutes.
How it happened
Manipulated AI: Agent hijack. Malware or poisoned configuration took control of AI tools already installed on the victim's machine and turned them against the victim.
Models from several AI vendors were involved. The product was Claude Code, Gemini CLI, Cursor, a type of coding assistant.
Impact
Data was exposed. Data involved: credentials. Many organizations were affected.
Severity is rated High, calculated from how far the incident reached and how sensitive the data was.
Was the AI at fault?
No. The failure was in the systems, settings or people around the AI, not in the model's behaviour.
Status and timeline
Confirmed by the affected organization, the AI vendor, a regulator or a named security research firm.
It became public on 5 Jun 2026.
GitHub disabled the 73 affected repositories, and they were restored after Microsoft and GitHub removed the malicious code.