Clean GitHub repo tricks AI coding agents into running malware
A novel attack technique targets AI coding agents by hiding malicious code in seemingly clean GitHub repositories. The attack uses repository structures and commit histories that appear legitimate, tricking the agents into executing malware instead of the intended code.
Background
- AI coding agents (Cursor, Copilot, Codex, etc.) are tools that autonomously read, modify, and run code from GitHub repositories based on natural-language prompts.
- Researchers at Veriti discovered a new attack: a clean GitHub repo with no malicious code visible to humans, but containing a cleverly crafted README that tricks an AI agent into executing a hidden "supply chain" attack script from a different source.
- The repo appears legitimate because the malware is not in the code itself — it is described only in natural-language instructions that the AI reads and follows.
- This matters because developers increasingly trust AI agents to autonomously handle coding tasks, and this attack bypasses traditional code-review safeguards (since the repo passes as clean) by exploiting the agent's tendency to follow text instructions without verifying their source.
- The technique highlights a new class of "prompt injection" and "indirect" attacks targeting the AI layer rather than the code layer.