Microsoft agentic AI attack — Jun 2026

What happened

On June 5, 2026, a supply chain attack targeted Microsoft’s Azure GitHub organizations by pushing a malicious commit to the Azure/durabletask repository. Using a previously compromised contributor account, the attacker planted configuration files designed to execute a 4.6 MB obfuscated JavaScript credential-harvesting payload. Unlike traditional supply chain attacks that target package managers, this incident specifically targeted the developer's local environment. The payload was configured to trigger automatically when a developer opened the repository in AI coding tools or IDEs, including Claude Code, Gemini CLI, Cursor, and VS Code.

The attack utilized four distinct vectors to achieve execution: a SessionStart hook for Claude Code and Gemini CLI, a prompt injection in Cursor’s setup.mdc file, and an auto-run task in VS Code. The commit was backdated to 2020 and included a [skip ci] flag to evade automated detection. Following the discovery, GitHub performed an automated sweep, disabling 73 repositories across four Microsoft organizations within 105 seconds. This action caused significant disruption to CI/CD pipelines, most notably breaking the official Azure/functions-action used by numerous developers. Microsoft initially attributed the repository outages to a policy violation before later characterizing the situation as an internal management issue under investigation.

According to StepSecurity, this incident is linked to the broader Miasma worm campaign, which has previously targeted various ecosystems including Mistral AI and TanStack. The same compromised contributor account was also implicated in a May 19 attack that involved poisoning Microsoft’s durabletask PyPI packages. Security researchers warn that any system where an affected repository was opened should be treated as compromised, with recommendations to rotate all accessible credentials, including GitHub tokens, cloud service keys, and SSH keys. The incident highlights a shift in threat actor tactics toward hijacking AI coding agents and editor configurations to bypass traditional supply chain defenses.