Miasma Campaign Exposes AI Coding Config Files as an Unreviewed Attack Surface
What happened
A CSO Online investigation published November 2, 2026, details the Miasma campaign. Attackers inserted credential-harvesting instructions into a Microsoft repository's AI coding tool configuration file. They did not modify application source code. StepSecurity's October 2026 analysis found the commit carried a skip-CI flag. This flag told the automated pipeline not to run security checks. The commit also carried a backdated timestamp designed to make the change look less suspicious. The malicious instructions activated when a developer opened the project folder, not when they ran any application. The article documents similar risks in configuration files used by Claude Code hooks and other AI coding assistants. It offers practitioner guidance on enforcing pull request review ownership and branch protection rules that most enterprises currently apply only to application code.
Why it matters
- ·Configuration files for AI coding assistants can run code and reach external services. Most software change-control programs do not require pull request review or branch protection for these files. That gap is what the Miasma campaign actively exploited.
- ·The skip-CI flag technique confirms that attackers are deliberately routing around automated pipeline security checks. Enterprises relying solely on those checks now have documented evidence that the control can be neutralized without a technical breach.
- ·Credential theft from developer environments gives attackers access to cloud services, source repositories, and downstream systems. An incident originating in a configuration file could trigger breach notification obligations under the GDPR and state privacy laws if personal data becomes accessible.
Stay ahead of stories like this
Get every Global AI governance development like this one, plus the rest of the week's developments. Every Thursday.
Recent issues
- Three separate incidents this week each created a new compliance action item: verify your AI vendors' data sourcing, demand agent monitoring coverage guarantees, and audit trusted app identities in your cloud environment.29 Oct
- Regulators, litigants, and attackers are all moving faster than most organizations' AI governance frameworks, shifting leverage away from deployers and toward those who can prove control, accountability, and honest disclosure.21 Oct
Free every Thursday. Unsubscribe anytime.
Governance controls affected
What to do now
- ☐Ask your engineering team to list every AI coding assistant in use and identify which configuration files those tools read at startup or folder-open, then confirm those files are covered by the same pull request review and branch protection rules as application source code.
- ☐Require that any commit touching AI coding tool configuration files must be approved by a named reviewer listed in a CODEOWNERS file, and verify that the branch protection rule cannot be bypassed by a skip-CI flag or equivalent pipeline-skipping instruction.
- ☐Review your pipeline audit logs for the past 90 days to identify commits that combined a pipeline-skip flag with a timestamp that does not match the author's normal activity pattern, which is the specific signature the Miasma campaign used to avoid detection.
- ☐Add AI developer tool configuration files to your software supply chain risk inventory and classify them at the same risk level as build scripts or deployment configuration, since they can execute code and reach external services with equivalent access.
- ☐Confirm with your engineering leads that Claude Code hook controls, Cursor rules files, and any similar assistant-specific configuration are included in your next software supply chain audit, and document the review owner for each.
What to watch next
The Miasma campaign is unlikely to be the last attack of this type. As AI coding assistants gain broader access to cloud credentials and local file systems, their configuration files become higher-value targets. Compliance teams should monitor whether major AI developer tool vendors introduce signed or integrity-verified configuration files. Teams should also watch whether NIST or sector regulators update software supply chain guidance to name AI tool configuration explicitly. The Five Eyes Guidance on the Careful Adoption of Agentic AI Services already signals that agentic developer tools carry supply chain risk. Formal requirements tying that guidance to pipeline controls may follow as incidents accumulate.