DIGGINGBEAGLE

Case · DiggingBeagle record

Microsoft open-source repositories delivered credential-stealing malware into AI developer workflows

Microsoft temporarily removed dozens of compromised GitHub repositories after attackers injected credential-stealing malware into open-source tools used in Azure and AI-development workflows. TechCrunch reported at least 70 repositories disabled; Microsoft said a small number of customers who may have pulled affected content were notified.

Agent-enabled software supply-chain attack
UnratedAI role: AGAINST AIAssessment method

At a glance

Mechanism and trust boundary

  1. 01

    Compromise open-source project content

    Malicious code is inserted into repositories developers may trust because of their Microsoft association.

    Boundary: repository maintainer trust / attacker-controlled code

  2. 02

    Developer pulls or opens affected content

    The project reaches a local development environment through ordinary open-source workflows.

    Boundary: remote repository / developer workstation

  3. 03

    AI coding tools become an execution context

    Affected content may be opened or acted on inside Claude Code, Gemini CLI, VS Code or related developer tooling.

    Boundary: project content / privileged development environment

  4. 04

    Credential-stealing payload targets local secrets

    The malicious content can attempt to collect passwords and other credentials available on the host.

    Boundary: development environment / account secrets

  5. 05

    Downstream impact remains only partially measured

    Microsoft notified a small number of customers, but public reporting does not establish the total number of downloads, stolen credentials or secondary compromises.

    Boundary: exposure / confirmed victim impact

Timeline

  1. 2026-05 (month precision)
    Event type unspecified

    Related Durable Task compromise is identified

    Later reporting references an earlier compromise of the project; continuity of actor or access into June is not established.

  2. Jun 8, 2026
    Event type unspecified

    Public reporting describes the broader Microsoft repository compromise

    TechCrunch reports at least 70 disabled repositories while Microsoft investigates and notifies a small number of potentially affected customers.

Claims & evidence

CLM-REPOSTechCrunch observed at least 70 Microsoft GitHub projects disabled while Microsoft investigated malicious content.supported

Basis: reported finding

Link to claim
CLM-SCALETechCrunch observed at least 70 Microsoft GitHub repositories disabled during the investigation, while Microsoft said only a small number of customers were notified as potentially having pulled affected content.supported

Basis: reported finding

Link to claim
CLM-IMPACTThe public reporting did not establish how many developers downloaded malicious content or whether downstream credential theft produced confirmed secondary compromises.unreviewed

Basis: reported finding

Link to claim
CLM-WORKFLOWAffected tools were used by developers inside AI coding environments including Claude Code and Gemini CLI; the AI tools were an execution context/target surface, not autonomous attackers.supported

Basis: reported finding

Link to claim
CLM-MECHANISMThe malicious code was planted in open-source projects and could steal passwords and other credentials when affected tools were opened through AI coding environments including Claude Code, Gemini CLI and VS Code.supported

Basis: reported finding

Link to claim
CLM-RECOMPROMISEThe June incident included a reported re-compromise of Microsoft's Durable Task project after a related compromise had been identified in May, raising a persistence or repeat-access question.contested

Basis: reported finding

Scope: TechCrunch attributes the re-compromise characterization to OpenSourceMalware; Microsoft did not publicly establish whether the same actor retained access.

Link to claim

Implications

AI coding assistants inherit the software-supply-chain risk of everything they can open, build or execute. The presence of Claude Code or Gemini CLI does not make the attack 'AI-driven,' but it can enlarge the authority available to a poisoned project because coding agents routinely have repository, shell and credential-adjacent access. Repository provenance and workstation isolation therefore remain core agent-security controls.

Controls and mitigations

  • Pin and verify trusted dependencies and repository revisions before running them in privileged developer environments.
  • Use disposable or least-privilege environments for untrusted open-source projects, including when AI coding agents are involved.
  • Keep developer credentials out of project-accessible files and process environments whenever possible.
  • Treat unexpected repository ownership, release or CI changes as supply-chain security events requiring credential rotation and provenance review.

Unknowns and contradictions

  • Number of affected developers and downstream systems remains undisclosed.
  • Public reporting does not establish attacker identity or whether the May and June compromises were the same intrusion.

The June incident included a reported re-compromise of Microsoft's Durable Task project after a related compromise had been identified in May, raising a persistence or repeat-access question. has a contested assessment or contradictory evidence.

Sources and citation

EvidenceTechCrunch - Microsoft open-source projects compromised to steal AI developer credentials

Material revision history

  1. Sep 18, 2026 · Published version · first publication · revision 4
  2. Sep 19, 2026 · Published version · material revision · revision 17Public fields changed: attack_path, implications, mitigations, narrative, timeline
Record metadata

Canonical ID: CASE-2026-MS-OSS-AI-DEV-SUPPLYCHAIN · revision 17

Legacy date (semantics unspecified): 2026-06-08. This value is not treated as an occurrence or disclosure date.