A worm called Miasma turned 70+ Microsoft repos into password-stealers for anyone using an AI IDE (techcrunch.com)
Open a poisoned repo in an AI coding IDE and a setup hook runs on its own, lifting your tokens. Harnesses like Codex or opencode reportedly dodged it.
The thread's correction to the headline: this isn't a hole in 'Microsoft's open source' so much as a supply-chain hit, and pulling 70+ repos fast was the right call, not the scandal.
A CISO's deeper worry: agents now juggle many unrelated projects at once, so the blast radius of one bad dependency just grew.
Sign in to save