OVHcloud reports that a compromised developer account replaced existing release assets with credential-stealing binaries. Their target list explicitly included Cursor, Continue, Cody, OpenCode, Hermes and Claude data stores alongside cloud secrets. The AI-security question is exposure of assistant histories and configuration, not unverified AI authorship of…
Inspect the ClaimsCase · DiggingBeagle record
Malicious OVHcloud CLI binaries targeted local AI-assistant stores
Assessment profile
Assessment method- Setting
- production
- Exploitation
- confirmed in the wild
- Evidence
- Grade B
- Remediation
- fixed reported
- AI role
- AGAINST AI
Basis and provenance
CLM-OVH-CLI-AI-STORES-1 reports: Affected assets were v0.11.0-v0.15.0 downloaded October 19 between 14:47 and 16:21 UTC+2. OVHcloud says source and build infrastructure were unaffected and release immutability was subsequently corrected. Source SRC-2026-CP17-OVH-CLI-OCT19 is located at 'Summary; Technical report timeline; Targeted resources'. The distinctive mechanism begins: A stolen developer GitHub identity modified downloadable compiled CLI release assets without changing the source code or normal build chain. Classification: setting=production, exploit_status=confirmed_in_the_wild, evidence_grade=B on the bounded original investigator/vendor or paper evidence, without independent dynamic replication. remediation_status=fixed_reported; scoped control or limit: Verify the exact binary hash and download time without running suspicious binaries, move to the clean signed-tag 0.16.0 release and rotate exposed local credentials if execution occurred. Making releases immutable closes the asset-swap opportunity but cannot revoke secrets already extracted. The null impact band avoids an ungrounded cross-Case severity rating; observed damage, targeted population and controlled test outcomes cannot be exchanged as the same quantity. Where a patch is described, its availability is separate from independently tested effectiveness.
Assessed Oct 23, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-OVH-CLI-AI-STORES-1 · CLM-OVH-CLI-AI-STORES-2 · OVHcloud: October 19 CLI release-asset compromise
At a glance
Downloaded assets do not establish execution or successful theft; assistant-store contents actually recovered remain unknown.
Limits and uncertaintyFull account
OVHcloud reports that a compromised developer account replaced existing release assets with credential-stealing binaries. Their target list explicitly included Cursor, Continue, Cody, OpenCode, Hermes and Claude data stores alongside cloud secrets. The AI-security question is exposure of assistant histories and configuration, not unverified AI authorship of the attack. Disclosure.
Mechanism, preconditions and effects. A stolen developer GitHub identity modified downloadable compiled CLI release assets without changing the source code or normal build chain. OVHcloud reports that the suspicious binaries were available for 93 minutes on October 19, affecting specific v0.11.0 through v0.15.0 download windows. Its analysis found collection targets in local AI assistant stores along with conventional application secrets. OVHcloud attributed the credential foothold to a malicious developer extension installed a year earlier on a personal machine.
Comparison and evidence limits. The vendor reported roughly 250 downloads during the window, not 250 successful executions or stolen AI sessions. The release-asset immutability issue and the earlier developer-account infection are two stages of the same supply-chain case, not a compromised OVHcloud source repository. The vendor says version 0.16.0 is unaffected.
Timeline
- Oct 19, 2026occurrence
Occurrence began
Claims & evidence
CLM-OVH-CLI-AI-STORES-1Affected assets were v0.11.0-v0.15.0 downloaded October 19 between 14:47 and 16:21 UTC+2. OVHcloud says source and build infrastructure were unaffected and release immutability was subsequently corrected.supported
Basis: reported finding
- supportsOVHcloud: October 19 CLI release-asset compromisevendor statement
Summary; Technical report timeline; Targeted resources
CLM-OVH-CLI-AI-STORES-2OVHcloud traced the developer-account compromise to color-picker-universal 2.8.91, installed on a personal MacBook on October 20, 2025; the release replacement later used stolen keys.supported
Basis: reported finding
- supportsOVHcloud: October 19 CLI release-asset compromisevendor statement
Root cause
Controls and mitigations
- Verify the exact binary hash and download time without running suspicious binaries, move to the clean signed-tag 0.16.0 release and rotate exposed local credentials if execution occurred. Making releases immutable closes the asset-swap opportunity but cannot revoke secrets already extracted.
Unknowns and contradictions
- Downloaded assets do not establish execution or successful theft; assistant-store contents actually recovered remain unknown.
Sources and citation
Material revision history
- Oct 23, 2026 · Canonical change recorded · new in release · revision 183