Clean GitHub repo tricks AI coding agents into running malware
A new supply-chain attack technique tricks AI coding agents into executing malware by hiding malicious code inside seemingly clean GitHub repositories. The attack exploits how AI agents clone and run code from repos without fully reviewing all files, allowing attackers to compromise developer environments.
Background
- AI coding agents are tools (e.g., Cursor, Copilot's agent mode, Devin) that can read GitHub repositories and autonomously write or execute code to accomplish tasks a user gives them.
- Researchers discovered a technique ("repojacking") where an attacker fills a GitHub repo with benign, legitimate-looking code but hides malicious instructions in siloed files—like markdown docs, config files, or commit messages—that the AI agent reads and acts on.
- Because the repo appears clean to human reviewers (the malware isn't in the main code), it can pass automated security scans and trick the agent into executing harmful commands, such as exfiltrating environment variables or installing backdoors.
- This is a new class of supply-chain risk: instead of poisoning the code itself, attackers poison the *context* that AI agents rely on to make decisions. The attack exploits the trust gap between what looks safe to a human and what an AI model will interpret as an instruction.