Miasma worm plants adversarial MCP configs across GitHub repos
A worm planted adversarial MCP configuration files (mcp.json) across 73 GitHub repositories, including Microsoft's azure/durabletask. Opening an affected repo in an AI coding agent auto-executed a credential-harvesting payload.
The worm wrote malicious mcp.json entries, hooks, and prompt injections into repositories so that opening one in an AI coding agent such as Claude Code, Cursor, or Gemini CLI ran its payload automatically. GitHub disabled 73 repositories across four Microsoft organizations after a compromised contributor account pushed a malicious commit to azure/durabletask. The payload harvested AWS, GCP, and Azure credentials, HashiCorp Vault tokens, GitHub Actions OIDC tokens, package-registry publish tokens, and SSH keys. Because it also wrote itself into agent and IDE config, the persistence survived token rotation and kept re-harvesting on later sessions.
Takeaway
Agent and IDE configuration files are executable attack surface, and opening a repository can be enough to run code. Treat MCP config as untrusted until reviewed, and disable auto-execution of tools defined by repository-supplied config.