Miasma Worm: How AI Coding Agents Got Hacked in a Devastating Supply Chain Attack

The Attack That Changed How We Think About AI Coding Tools

On June 5, 2026, security researchers at Rescana and StepSecurity dropped a bombshell: a sophisticated supply chain attack dubbed "Miasma Worm" had compromised 73 Microsoft GitHub repositories — including Azure Functions Action — by exploiting the very AI coding agents that developers trust to write their code. The attack specifically targeted tools like Claude Code, Cursor, GitHub Copilot, and other AI-powered coding assistants through their Model Context Protocol (MCP) integrations and prompt-handling pipelines.

This isn't a theoretical vulnerability. This is a real, in-the-wild attack that infected production infrastructure at one of the world's largest technology companies. If Microsoft's repositories can be compromised through AI coding agents, every developer and organization using these tools needs to pay attention.

Here's everything we know about the Miasma Worm attack, how it works, and what it means for the AI coding tools you use every day.

What Is the Miasma Worm Attack

The Miasma Worm is a supply chain attack that poisons the context pipeline of AI coding agents — the mechanism by which these tools read your codebase, understand project structure, and generate suggestions. Instead of attacking the code directly, the attackers manipulated the data that AI agents ingest to produce their outputs.

Think of it this way: if an AI coding agent is a chef, the Miasma Worm doesn't tamper with the chef — it poisons the ingredients. The chef still follows the recipe perfectly, but the meal is contaminated because the inputs were malicious.

The attack was discovered when security monitoring tools flagged anomalous commits across dozens of Microsoft-maintained GitHub repositories. The commits appeared legitimate — they used proper commit message formatting, referenced valid issue numbers, and were attributed to known maintainers. But buried inside the diffs were subtle modifications: hardened credentials, exposed API endpoints, and backdoor logic that could be triggered remotely.

StepSecurity's analysis revealed that the attack was propagated through MCP (Model Context Protocol) server configurations — the mechanism that AI coding agents use to connect with external tools, documentation, and data sources. By compromising a single shared MCP server that multiple repositories relied on, the attackers were able to inject malicious instructions that cascaded across every repository using that server.

How the Attack Works: Step by Step

Security researchers have reconstructed the attack chain. Here's how the Miasma Worm operated:

Phase 1: MCP Server Compromise

The attackers identified a widely-used community MCP server that provided documentation lookup and dependency management features. Through a combination of prompt injection and a stolen maintainer credential, they gained the ability to modify the server's responses to AI agent queries.

Phase 2: Context Poisoning

When an AI coding agent (like Claude Code or Cursor) queried the compromised MCP server for context — say, to look up the correct API for a dependency — the server returned not just the legitimate documentation but also invisible instructions embedded in comments, whitespace, and metadata that the AI agent would process but humans wouldn't see.

Phase 3: Malicious Code Generation

The poisoned context caused the AI agents to generate code that included subtle security vulnerabilities: hardcoded credentials disguised as environment variable defaults, API calls to attacker-controlled endpoints mixed into legitimate logging statements, and logic bombs triggered by specific input patterns.

Phase 4: Self-Propagation

The worm earned its name from its ability to spread. The injected code included modifications to the repository's own MCP configuration files, causing any developer who cloned the repository and used an AI coding agent to automatically connect to the compromised MCP server — turning each new victim into a vector for further spread.

Which AI Coding Tools Were Affected

The attack targeted the MCP ecosystem broadly, meaning any AI coding agent that uses MCP integrations was potentially vulnerable. The tools confirmed or suspected to be in the attack chain include:

• Claude Code (Anthropic): One of the most popular AI coding agents in 2026, Claude Code's deep MCP integration made it a primary vector. Anthropic has since released an emergency security update.
• Cursor: The AI-first code editor's MCP-based extension system was exploited to inject malicious context into developer workflows.
• GitHub Copilot: Microsoft's own Copilot was used against Microsoft's own repositories in a painful irony. Copilot's reliance on repository context for suggestions made it susceptible to the poisoned data.
• OpenAI Codex: The autonomous coding agent was identified as another potential vector, though OpenAI has not confirmed direct involvement in the Microsoft incident.
• Other MCP-compatible tools: Any tool using the Model Context Protocol to connect with external data sources was theoretically vulnerable, including editors like Zed and VS Code with MCP extensions.

It's important to note that the vulnerability was not in the AI models themselves but in the infrastructure surrounding them — specifically, how MCP servers handle and serve context to AI agents. The AI models faithfully executed on malicious instructions that were invisible to human reviewers.

The Damage: What Was Compromised

The scope of the Miasma Worm attack is still being assessed, but here's what's known so far:

• 73 Microsoft GitHub repositories were confirmed compromised, including the widely-used Azure Functions Action — a GitHub Action used by thousands of CI/CD pipelines worldwide.
• Microsoft disabled the affected repositories and revoked associated credentials within hours of discovery, preventing further propagation.
• Downstream impact is still being calculated: Any project that imported or depended on the compromised repositories may have inherited malicious code through their dependency chains.
• No known data breaches have been attributed to the injected vulnerabilities yet, but researchers warn that the backdoors could have been active for days before detection.

Why AI Coding Agents Are Perfect Targets

The Miasma Worm exploit exposes a fundamental tension in how AI coding tools work. These agents are powerful precisely because they can ingest enormous amounts of context — your entire codebase, documentation, dependencies, and external APIs — to generate accurate, contextual code suggestions. But this same capability creates a massive attack surface.

Several factors make AI coding agents uniquely vulnerable to supply chain attacks:

• Trust in AI outputs: Developers have learned to trust AI coding suggestions, often accepting them without the same level of scrutiny they'd apply to code from an unknown human contributor.
• Invisible instructions: Prompt injection attacks can embed directives in data that humans can't easily see but AI models process as commands. This asymmetry is difficult to defend against.
• MCP expansion: The Model Context Protocol has rapidly become the standard way for AI agents to connect with external tools. The ecosystem has grown faster than its security infrastructure.
• Autonomous operation: Agentic AI tools like Claude Code and Codex can make code changes autonomously — committing, pushing, and even creating pull requests without human review at each step.
• Complex trust chains: A single AI coding session might pull context from your codebase, a package registry, three MCP servers, and a documentation site. Each link in this chain is a potential attack vector.

How to Protect Your Codebase

The Miasma Worm is a wake-up call, but it doesn't mean you should abandon AI coding tools. Here are concrete steps to protect yourself:

1. Audit Your MCP Server Configuration

Review every MCP server your AI coding agents connect to. Remove any you don't explicitly recognize or need. Pin MCP server versions and verify checksums, just as you would with any dependency.

2. Require Human Review for All AI-Generated Commits

If your AI agent is committing code directly to your repository, stop. Implement a mandatory human review step for any changes generated or suggested by AI tools. Use worktrees and branches to isolate AI-generated code until it's been reviewed.

3. Use Sandboxed Environments

Run AI coding agents in sandboxed environments with no access to production credentials, sensitive files, or network resources beyond what's strictly necessary. Tools like Daytona and E2B provide secure sandboxed environments specifically designed for AI coding agents.

4. Monitor for Anomalous Commits

Implement automated scanning of commits for patterns associated with AI-generated code injection: unexpected credential patterns, calls to unfamiliar endpoints, or modifications to configuration files that weren't part of the intended change.

5. Keep AI Tools Updated

Both Anthropic and Cursor have released security patches in response to the Miasma Worm. Ensure your AI coding tools are running the latest versions with all security updates applied.

What This Means for AI Tool Adoption

The Miasma Worm attack is a watershed moment for AI tool security. It demonstrates that as AI coding tools become more autonomous and more deeply integrated into development workflows, the attack surface grows proportionally. The very features that make these tools powerful — deep codebase understanding, autonomous action, and external tool integration — are the same features that create security risks.

For organizations, this attack reinforces a principle that security professionals have been emphasizing: AI tools need the same security scrutiny as any other dependency in your stack. You wouldn't install an unvetted npm package with access to your production database. You shouldn't connect an unvetted MCP server to your AI coding agent with access to your entire codebase.

Expect the industry to respond rapidly. MCP security standards will likely be formalized in the coming weeks. AI coding tool vendors will add sandboxing, context validation, and anomaly detection features. And organizations will develop AI tool security policies that parallel their existing software supply chain security frameworks.

The tools themselves aren't going away — AI coding agents are simply too productive to abandon. But the era of blindly trusting AI-generated code is over. The developers and organizations that thrive will be the ones that combine the productivity gains of AI coding tools with rigorous security practices.

Frequently Asked Questions