"… developers who used AI agents to work with them should assume their systems are compromised…Compromised dev creds led...

"… developers who used AI agents to work with them should assume their systems are compromised…Compromised dev creds led to a legitimate GitHub OIDC token being requested. This was followed by a malicious build being published with valid SLSA provenance, which ultimately led to conventional scanners seeing it as a routine trusted update… able to act exactly as an authenticated publisher."https://arstechnica.com/security/2026/06/for-the-2nd-time-in-weeks-microsoft-packages-laced-with-credential-stealer/ https://404media.co/microsoft-hacked-to-deliver-malware-to-claude-and-gemini-users/#GitHub #Microsoft #AI #Claude #Gemini #Malware