A worm called Miasma turned 70+ Microsoft repos into password-stealers for anyone using an AI IDE
Microsoft disabled dozens of its own GitHub projects after attackers slipped credential-stealing code into tools that auto-execute when opened inside Cursor, VS Code, Claude Code or Gemini's CLI.
Open a poisoned repo in an AI coding IDE and a setup hook runs on its own, lifting your tokens. Harnesses like Codex or opencode reportedly dodged it.
The thread's correction to the headline: this isn't a hole in 'Microsoft's open source' so much as a supply-chain hit, and pulling 70+ repos fast was the right call, not the scandal.
A CISO's deeper worry: agents now juggle many unrelated projects at once, so the blast radius of one bad dependency just grew.
What actually got compromised
TechCrunch reports that Microsoft disabled at least 70 of its own GitHub repositories after attackers injected password-stealing malware — a worm the security community is calling Miasma — into open-source projects used by AI developers, including tools tied to Azure and to AI coding apps. Credentials were lifted when developers opened the compromised tools inside an AI IDE. The Durable Task project was first compromised in mid-May 2026, with the June incident described as a possible re-compromise. Spokesperson Ben Hope said Microsoft "temporarily removed some repositories" while investigating and notified affected customers.
The mechanism is the important part, and the thread spelled it out more precisely than the headline:
"setup adds config to be auto executed by people who work on the repo. They would have to use vscode/cursor/claude/gemini. People who use codex / opencode / other harnesses are safe I guess." — a commenter reconstructing the attack path
The headline correction: this isn't a flaw in "Microsoft's open source"
The most-upvoted response objected to the framing itself.
"steal passwords of AI developers — What does this even mean? … Or it steals API tokens, which serve a similar function as passwords." — a commenter who read past the headline to the primary writeup
The consensus that followed: this is a supply-chain attack on open-source repos, the same class of risk as a poisoned npm or pip package, and Microsoft disabling the repos quickly was the correct response rather than the scandal.
The token hygiene nobody wants to talk about
Two practitioners pointed at the unglamorous root causes — long-lived classic tokens and broken access models.
"I strongly suspect this is a case of classic personal access tokens being used in an unclean way … The fact that classic tokens are even still allowed blows my mind." — a commenter with multi-org GitHub policy experience
"now coding assistants and engineers are working on multiple unrelated projects simultaneously … The risk of supply chain issue has increased dramatically in the enterprise." — a CISO building a chatbot platform
The blunt mitigation, from someone who writes about this:
"Nobody should do 'npm install' or 'pip install' on their machine. Using a proper sandboxing … will drastically limit the blast radius of these attacks." — Ashish, a software engineer and blogger
The uncomfortable takeaway: the thing that made this attack work isn't a Microsoft bug. It's that AI coding tools execute repo configuration automatically, across more projects than any human used to touch in a day — so the cost of one careless token went up with the convenience.
Get breakdowns like this every day
The top Hacker News stories, unpacked — by email, Telegram, or RSS.
AI is the new rockstar developer: brilliant, novelty-obsessed, and it leaves you the cleanup
Jesse Skinner argues coding models behave like the worst kind of star engineer — generating tens of thousands of lines nobody else can maintain. An engineer on two hours' sleep after a SEV-0 had a blunter version.