AI Agent Backdoors Trivy Security Scanner, Weaponizes a VS Code Extension(grith.ai)

2 pointsby edf134 miesiące temu1 comments

AI Agent Backdoors Trivy Security Scanner, Weaponizes a VS Code Extension

https://grith.ai/blog/ai-agent-compromised-trivy-weaponized-vscode-extension

2 comments

edf134 miesiące temu

An autonomous AI agent exploited a CI misconfiguration in Trivy (32k+ stars, 100M+ annual downloads), stole publishing tokens, deleted all 178 releases, and published a weaponized VS Code extension - in 44 minutes.

The extension's payload targeted five AI coding agents (Claude Code, Codex, Cursor, Windsurf, Copilot) with tool-specific flags to bypass their permission systems. First documented case of an AI agent attacking a supply chain and then using the compromised artifact to target other AI agents. CVE-2026-28353, CVSS 10.0.

Mooshux4 miesiące temu