Poisoned Pipeline / Techniques / T0210
Poison AI coding-agent config or workspace
The attacker writes into hidden agent directories and config that
developers and CI treat as local clutter — .claude/, .cursor/,.vscode/, Copilot/Gemini/Codex settings, MCP server entries, or
Python .pth startup hooks. The next time the human or the agent
opens the project, attacker instructions run with the developer's
already-granted tools. Uninstalling a malicious package does not
clear this. Observed in Morphisec's Hades campaign, GTIG DUSTMAKER,
and Mandiant's hijacked coding-assistant case.
Where this idea came from
Hades, Claude Code hooks; DEF CON 34: “The Sandbox is a Suggestion”, “No Prompt Required: Pre-Task RCE in Google Gemini CLI”, “Hacking Your Life with AI”, “Wrestling with a Python”, and “Your WAF Blocked Us” (Sternberg/Poran/Bobrov) — WAF logs and Sentry traces poison the agent, Seer infects Cursor, persistence is config poisoning. Catalog: content/portal/talks.yaml.
- https://www.morphisec.com/blog/when-your-ai-coding-assistant-becomes-the-attack-the-hades-supply-chain-campaign/
- https://cloud.google.com/blog/topics/threat-intelligence/from-prompting-to-autonomy-the-evolution-of-adversarial-ai
- https://cloud.google.com/security/resources/ai-risk-and-resilience-2026
- https://www.blackhat.com/us-26/briefings/schedule/index.html
- https://defcon.org/html/defcon-34/dc-34-speakers.html#content_66668
- https://defcon.org/html/defcon-34/dc-34-speakers.html#content_66604
- https://defcon.org/html/defcon-34/dc-34-speakers.html#content_66656
- https://defcon.org/html/defcon-34/dc-34-speakers.html#content_66644
- https://defcon.org/html/defcon-34/dc-34-speakers.html#content_66642
Mitigations
- M1220 Use only trusted third-party Github actions from reputable sources
- M1120 Store credentials in vault
- M1720 Implement regular patches and updates
Detections
- D1510 Implement Intrusion Detection System and anti-malware
- D1590 Implement continuous monitoring and logging of the CI/CD process
Observed in incidents (18)
- MCP configuration poisoning (text-file machine takeover)
- tensorlake 0.5.144 steals tokens, then wipes the home directory if they are revoked
- PolinRider poisons visanduma/nova-two-factor Packagist via Git
- actions-cool GitHub Action tags still serve Mini Shai-Hulud after re-enablement
- Cline v2.3.0 prompt-injection to unauthorized actions
- Amazon Q extension prompt injection
- GhostAction steals CI secrets, then autoruns a stealer from a fake font
- Hijacked AI coding assistant spreads Shai-Hulud
- TeamPCP DUSTMAKER AI workspace poisoning
- Typosquat npm packages backdoor Claude Code SessionStart
- Apex Accelerator published a malicious npm coding agent and a fake audit MCP
- Azazel harvested GitLab CI secrets and called a local MCP tool on a victim
- DPRK VS Code dictionary and tasks.json droppers
- Hades .pth and AI-assistant config persistence
- testmetest npm names ship a Miasma-family worm that wipes the home directory if a stolen GitHub token is revoked
- hackerbot-claw autonomous GitHub Actions exploitation
- npm packages hijack Cursor on macOS
- Malicious ClawHub / OpenClaw skills