Skip to main content
Incident intelligence/SS-IR-085CASE FILE OPEN
Symbolic editorial illustration for SS-IR-085SERVANTSTACK // INCIDENT INTELLIGENCEFORENSIC IMAGE // VERIFIED FRAME
SS-IR-085 // INCIDENT REPORTReported

Miasma Worm

A Self-Replicating Supply Chain Attack Hijacks AI Coding Agents to Compromise 73 Microsoft GitHub Repositories

EXECUTIVE BRIEF

On June 5, 2026, the self-replicating Miasma worm compromised 73 Microsoft repositories across four GitHub organizations - Azure, Azure-Samples, Microsoft, and MicrosoftDocs - including Azure/functions-action, the official GitHub Action used to deploy Azure Functions.

AGENTIC AIDATA & CYBER SECURITY
FAILURE CHAINTRACE COMPLETE
  1. 01TRIGGEROn June 5, 2026, the self-replicating Miasma worm compromised 73 Microsoft repositories across four GitHub…
  2. 02MACHINE ACTIONAutonomous actor
  3. 03MISSING GATETrust boundaries, least privilege, and output approval
  4. 04IMPACTData security
01 // INCIDENT SUMMARY

The short version

On June 5, 2026, the self-replicating Miasma worm compromised 73 Microsoft repositories across four GitHub organizations - Azure, Azure-Samples, Microsoft, and MicrosoftDocs - including Azure/functions-action, the official GitHub Action used to deploy Azure Functions.

02 // KEY FACTS

Case telemetry

INCIDENT
SS-IR-085
DATE
June 5, 2026
SYSTEM
Miasma Worm
LOCATION / SCOPE
Microsoft GitHub organizations
EVIDENCE
Reported
AI ROLE
Autonomous actor
HARM
Data security
SOURCES
2 cited records
03ENTRY POINT // WHAT HAPPENED

The event

On June 5, 2026, the self-replicating Miasma worm compromised 73 Microsoft repositories across four GitHub organizations - Azure, Azure-Samples, Microsoft, and MicrosoftDocs - including Azure/functions-action, the official GitHub Action used to deploy Azure Functions. Using a previously compromised contributor account, the attacker pushed a malicious commit to Azure/durabletask that planted a set of configuration files and a 4.6 MB obfuscated payload (setup.js). The files were wired to execute automatically the moment the repository was opened in a developer's AI coding tool. GitHub's automated abuse detection disabled all 73 repositories in a two-wave takedown spanning 105 seconds. The breach was the third escalation of a campaign that began June 1 with 32 poisoned @redhat-cloud-services npm packages and widened on June 3 to 57 more across the npm registry.

04CAUSAL TRACE // AI'S ACTUAL ROLE

What the machine did

The worm did not exploit a software bug - it weaponized the automation built into AI coding assistants. A .claude/settings.json file embedded a Claude Code SessionStart hook, and a matching .gemini/settings.json hooked Gemini CLI, each running "node .github/setup.js" the instant a coding session started. A .cursor/rules/setup.mdc file used prompt injection with "alwaysApply: true" to instruct Cursor's agent to run the payload as a mandatory setup step, while a .vscode/tasks.json task fired on "folderOpen" with no user action at all. No human reviewed or approved any of this: simply opening the repository in an agent was enough to harvest credentials for AWS, Azure, GCP, Kubernetes and 90+ developer tools, then reuse the stolen GitHub tokens to propagate to the next repository.

Autonomous actorAutomation was a causal participant—not a decorative label for the system around it.
05BLAST RADIUS // CONSEQUENCES

Where the failure landed

Miasma is among the first self-replicating worms documented to spread specifically by hijacking AI coding agents, turning "open a repo" into a live security boundary. It harvested cloud and developer credentials at scale, republished npm packages, and forced the takedown of critical Microsoft infrastructure including the official Azure Functions deployment action. Researchers linked it to the earlier Mini Shai-Hulud worm from the threat group TeamPCP, with the same compromised account reused across the May PyPI attack and the June GitHub incident - evidence of a campaign evolving its techniques daily and treating autonomous developer tooling as its primary propagation engine.

06 // EVIDENCE STATUS

Reported

Documented in the cited public record. Follow the sources for the precise evidentiary posture.

SOURCE RECORD UPDATED 2026-07-09

07 // SOURCE LEDGER

2 cited records

  1. 01
  2. 02
    Primary / officialStepSecurity (June 2026)
08CONTROL FAILURE // MISSING GOVERNANCE

Trust boundaries, least privilege, and output approval

The failure pattern in this case: Untrusted input crossed a privileged boundary.

09INTERVENTION POINT // HUMAN IN THE MIDDLE

The moment the path could change

A security owner approves credential scope and externally visible actions before the agent can cross a trust boundary.

AI PROPOSES→HUMAN OWNS THE DECISION→SYSTEM EXECUTES
10CONTROL DEPLOYMENT // AUTHORITYGATE

Trust boundary policy · output approval

AuthorityGate's framework treats an agent's autonomy - executing hooks, tasks, and tool calls drawn from untrusted code - as a privilege that a qualified human must grant before it runs, not a default the tool assumes. Auto-executing a SessionStart hook, a folder-open task, or an injected "mandatory setup" instruction from a freshly opened repository is exactly the unsupervised behavior the framework gates: a named human checkpoint stands between untrusted repository content and any command that touches credentials or the filesystem. The failure here was that the AI agent was trusted to act the instant it read attacker-controlled files, with no one in the loop to refuse.

CLOSELY MATCHED AUTHORITYGATE ANALYSISSupply Chain Attack via Poisoned CI/CDA deeper analysis of poisoned AI-development supply chains, credential theft, and predeployment validation.
12 // THE ALTERNATIVE

Autonomy is a design choice.

See the operating model that keeps AI useful while preserving human authority at consequential moments.

Compare AgenticAI and AugmentedAI →