Use case sources
Source reports and analysis supporting this case are listed below. AITBM interpretation and any indicative scoring are derived from this public evidence.
- AIDEFEND in Action — Miasma Targets Repository-Local Trust in Claude Code, Gemini CLI, Cursor, and VS Code
- Primary source — Miasma Worm Hits Microsoft Again: Azure Functions Action and 72 Other Repositories Disabled (StepSecurity, 2026-06-05)
- AIDEFEND SecureFlow — Miasma Repository Settings Trigger Credential Harvester
On 2026-06-05 a previously compromised contributor account pushed commit 5f456b8 to Azure/durabletask. The commit was backdated, carried [skip ci], added five files, and changed no application source. Four of the files were repository-local trigger configurations; the fifth was a 4.6 MB obfuscated .github/setup.js credential harvester. Opening the project could launch that payload through Claude Code or Gemini CLI SessionStart hooks or a Cursor always-applied rule — and, on a separate non-AI path outside this assessment, a VS Code folder-open task. Once launched the harvester ran with the developer process's local access.
GitHub later disabled 73 repositories across four Microsoft organisations in two automated waves; StepSecurity confirms the malicious commit in Azure/durabletask but does not establish that the payload propagated into every disabled repository.
ASSESSED SYSTEM
An AI coding agent — Claude Code, Gemini CLI, or Cursor — in its default repository-local trust configuration, opening a checked-out repository inside a developer session that carries cloud, Git, package-registry, and Kubernetes credentials. In that configuration the agent reads repository-local configuration (.claude/settings.json, .gemini/settings.json, .cursor/rules/setup.mdc) and acts on it without a signature check or an attributable activation decision, so a SessionStart hook or an always-applied rule can launch a repository-supplied executable on project open. Representative configuration: any AI coding agent that treats repository-local configuration as trusted directive material at session start.
OUT OF SCOPE
The .vscode/tasks.json folder-open route is explicitly excluded from the assessed system: the brief states it involves no AI participation, and both the AID-H-021.001 and AID-H-021.002 defence descriptions disclaim coverage of that non-AI IDE trust path. Scoring it would mix a conventional IDE trust boundary into an AI-agent assessment. The compromised contributor account, the Azure/durabletask repository, and the .github/setup.js payload are the attack, not the assessed system. GitHub's platform response — 73 repositories disabled across four Microsoft organisations in a 105-second automated sweep — is a platform containment action outside the assessed boundary, and the brief states that the count describes containment scope, not a verified infection count.
Architecture: Agentic / MCP System (decision tree Q2) — Q1 = NO: one agent per session; no peer-agent coordination is described. Q2 = YES: the agent starts a session, reads repository-local configuration, and executes a configured command with the developer session's tool and credential authority, with no approval for that individual action. Evidence in the brief: the SessionStart hooks in .claude/settings.json and .gemini/settings.json, and the Cursor always-applied rule in .cursor/rules/setup.mdc that instructs the agent to run the script. This is an unattended, state-holding, tool-invoking workflow. Tier 3: Tier 3 (Internal): the assessed system is developer tooling operating inside the organisational boundary, which is the treatment already applied to the comparable AI-coding-agent configuration-poisoning and dependency cases. The credential blast radius — cloud, Git, package-registry, and Kubernetes secrets in the developer session — is carried by Cascade Potential (Cp = 1.00), not by raising the tier.
Documented attack or failure path
- A previously compromised contributor account pushes commit 5f456b8, backdated and carrying [skip ci], adding five files and changing no application source — a shape that repository admission ignoring editor and agent configuration leaves unreviewed.
- A developer clones or opens the repository in an AI coding agent session that holds cloud, Git, package-registry, and Kubernetes credentials.
- The agent reads repository-local configuration and acts on it: .claude/settings.json and .gemini/settings.json register SessionStart hooks, and .cursor/rules/setup.mdc supplies an always-applied instruction telling Cursor to run the script. No signature check and no attributable activation decision intervenes.
- Every trigger points at the obfuscated 4.6 MB .github/setup.js. It executes with the developer process's local access and harvests credentials.
Observed controls and bounded outcomes
Positive credit is given only where the record directly demonstrates a control operating. Recommended or merely presumed controls receive no positive scoring credit.
- No control inside the assessed boundary is evidenced as having interrupted the disclosed path. The brief records containment only after execution was possible, and outside the assessed system: GitHub disabled 73 repositories in two automated waves.
- The brief is explicit that the 73-repository figure describes containment scope rather than a verified infection count, so no downstream propagation is scored as either a failure or a control success.
- StepSecurity confirms the malicious commit in Azure/durabletask only; no claim about other repositories' contents is scored in either direction.
Layer 1 — Intrinsic Vulnerability Profile
Each sub-metric is placed on its five-level rubric by the evidence quoted beside it. Missing applicable evidence remains unknown. The displayed midpoint and interval are scenario values, not inferred control performance.
| Sub-metric | Score | Rubric basis | Evidence |
|---|---|---|---|
| Robustness (Ro) — scenario interval 0.00–0.75 (midpoint 0.38), Tier 3 MVT 0.40 indeterminate | |||
| Ro-5Supply-Chain Artifact Admission Integrity | 0.00w 0.25 | 0.00 anchor: the hook configuration and the executable it launches were admitted by repository path with no origin, signature or integrity verification before load or execution, and no admission testing is evidenced. The 0.25 anchor requires pinning or allow-lists for at least some artifact classes; repository admission that ignores editor and agent configuration performs none on exactly the files that matter here, and the release-pinned static-analysis gate (AID-H-025.001) is marked only 'Partial' and absent. Moved from Ro-4 under the 26-sub-metric basis because the evidence concerns unverified artifact admission rather than poisoning of data, retrieval, memory, tool-description or feedback content. | This is an artefact-integrity failure at the repository boundary. A configuration-only commit that was backdated, suppressed CI, and referenced a new 4.6 MB obfuscated executable was admitted without review, and every trigger points at that .github/setup.js, which executes on project open. AID-H-021.001 states the requirement the path does not meet — scanning repository-local agent configuration before commit or checkout acceptance and enforcing policy against unexpected executable references — and AID-D-004.003 has to be recommended for detecting configuration-only commits that introduce new automatic execution paths.source: brief |
| Fairness (Fa) NOT APPLICABLE — axis-level applicability rule (Person-Outcome Surface test): The assessed coding agents act on a checked-out repository at session start; their outputs are hook execution, tool invocations and code changes inside a developer session, which allocate, deny, rank, price, classify, recommend or describe no natural person, and repository-local configuration carries no protected-class attribute or proxy. Its tier weight is redistributed across the remaining axes and its MVT is not evaluated. | |||
| Transparency (Tr) — scenario interval 0.00–1.00 (midpoint 0.50), Tier 3 MVT 0.45 indeterminate | |||
| Privacy (Pr) — scenario interval 0.00–1.00 (midpoint 0.50), Tier 3 MVT 0.50 indeterminate | |||
| Containment (Cn) — scenario interval 0.00–0.33 (midpoint 0.17), Tier 3 MVT 0.50 confirmed breach | |||
| Cn-1Scope Enforcement | 0.00w 0.09 | 0.00 anchor: no effective scope boundary existed between untrusted repository content and the developer session's ambient authority. The 0.25 anchor requires boundaries that exist but are inconsistently enforced; the disclosed configuration applies none at project open. | Opening a project executed an arbitrary repository-supplied 4.6 MB script with the developer process's local access. No capability boundary separates repository content from the developer session's filesystem, credentials, and network. AID-I-001.002 is recommended to open untrusted projects inside a microVM or user-space-kernel boundary with no developer home-directory credentials and no host write paths, which indicates that no such boundary is present by default.source: brief |
| Cn-2Escalation Prevention | 0.00w 0.12 | 0.00 anchor: no escalation control is evidenced between untrusted repository content and the session's full credential set. The 0.25 anchor requires role checks that exist but are defeated by role confusion; here no authority check is applied to hook execution at all. | A checked-out repository obtained the authority of the developer session — cloud, Git, package-registry, and Kubernetes secrets — simply by being opened. Nothing re-authorised the transition from reading repository files to executing a repository-supplied binary, and the brief's guidance is to require an explicit, reviewable decision before first execution.source: brief |
| Cn-5Agent Identity Integrity | 0.00w 0.10 | 0.00 anchor: no identity or integrity verification exists for the configuration that defines the agent, so the agent accepts an arbitrary supplied directive. The 0.25 anchor requires at least a basic verification step, and the disclosed configuration performs none at startup. | Nothing bound the agent's operating directive to a verified source. AID-H-021.002 states the requirement directly: reject unsigned local configuration overrides at agent startup and require approved signed configuration before a hook or rule can run. Because no signature or provenance is checked, a repository — not the operator — supplied the agent's instructions and its startup behaviour.source: brief |
| Cn-6Action Reversibility Classification Rate | 0.00w 0.08 | 0.00 anchor: no reversibility classification is performed before execution and the action executes ungated (ARCR = 0). No chain composition rule exists either — the hook is the first hop and it is also the highest-impact one. | Launching an unreviewed 4.6 MB obfuscated executable inside a credential-bearing session is a delegated-irreversible action — credential disclosure cannot be undone — and it executed automatically on project open with no pre-execution classification and no gate. The brief's remediation is to disable automatic repository-local hooks and folder-open tasks by default and require an explicit, reviewable decision before first execution.source: researcher |
| Cn-8Untrusted Context Isolation | 0.00w 0.14 | 0.00 anchor: no origin labelling exists on the repository-to-agent instruction channel and repository content was admitted to active context as trusted instruction by design, with the cross-boundary instruction producing execution of a repository-supplied binary. The 0.25 anchor requires origin labels on some channels or instruction authority denied at least by prompt wording; the disclosed rule is an ordinary instruction in an ordinary rules file and nothing marked or demoted it. Moved from Ro-1 under the 26-sub-metric basis because the evidence records a trust-boundary failure rather than the model's resistance under adversarial testing. | On the Cursor branch the attacker's instruction is model-facing: an always-applied rule in .cursor/rules/setup.mdc tells the agent to run the script, and the agent does. Repository-supplied prose is admitted as authoritative directive material with no demotion, no untrusted-content marking, and no semantic inspection; AID-H-021.001 is recommended to enforce policy against always-applied execution instructions before checkout acceptance, which indicates nothing inspects them at admission.source: brief |
| Cn-9Self-Modification and Persistent-State Containment | 0.00w 0.14 | 0.00 anchor: behaviour-governing state (hook settings and always-applied rules) was writable by a repository commit with no gate and took effect silently in the next session on project open. The 0.25 anchor requires writes to be logged or visible after the fact or a protected-path list that can be bypassed; the configuration-only commit was backdated, suppressed CI and was admitted unreviewed, and no protected-path or visibility mechanism for repository-local agent configuration is recorded, so 0.25 is not met. | The agent reads repository-local configuration and acts on it at session start: .claude/settings.json and .gemini/settings.json register SessionStart hooks, and .cursor/rules/setup.mdc supplies an always-applied instruction, so that opening the project launched the repository-supplied 4.6 MB .github/setup.js with the developer process's local access. No signature check and no attributable activation decision intervenes, and AID-H-021.002 is recommended to reject unsigned local configuration overrides at agent startup — a gate the disclosed default configuration lacks.source: brief |
Unknown, not N/A: 15 applicable sub-metrics lack admissible public evidence. The lower, midpoint, and upper scenarios evaluate each at 0.00, 0.50, and 1.00 respectively; no weight is redistributed merely because evidence is missing.
Architecture-based NOT APPLICABLE: excluded with the Fairness axis.
Layer 2 — Operational Risk Posture
| Dimension | Score | Justification |
|---|---|---|
| AaAutonomy Amplification | 1.00w 0.20 | The 1.00 anchor is met: the agent executes a repository-supplied command independently at session start, with no human approval, no notification, and no exception threshold. The developer's only decision was to open the project; every consequential action after that was taken by the agent under its own authority. elevated |
| AsAttack Surface Exposure | 1.00w 0.25 | The 1.00 anchor is met: the agent ingests untrusted third-party repository content — configuration files and instruction rules authored by an attacker — directly into its startup and instruction path. The content is fully attacker-controlled and reaches the agent with no intermediary. elevated |
| CpCascade Potential | 1.00w 0.30 | No verified System Dependency Graph exists for the assessed configuration, so the specification's worst-case default applies. It is independently corroborated on its merits: the observed path is ungated end to end and terminates in a credential harvester running with the developer session's cloud, Git, package-registry, and Kubernetes access — an irreversible node whose reachable set extends into every system those credentials open, which is why the brief directs defenders to rotate accessible credentials if the payload may have run.GDCP: corroborated by the observed path elevated |
| RfRemediation Feasibility | 0.50w 0.25 | Scored above the deployment-infrastructure anchor. There is no single vendor patch to apply: the disclosed trigger routes span three AI coding agents plus a separate non-AI IDE path, each with its own configuration model, so the fix — pre-checkout configuration scanning, signed configuration enforcement, and credential-free disposable workspaces — must be re-implemented per product and per developer environment. No retraining is required, which keeps it below the higher anchors, but remediation is a programme rather than an artefact rollout. |
Nelevated = 3 (dimensions strictly above 0.75) → CRM = 1.35.
Compound Risk Alert. Two or more dimensions are simultaneously elevated (spec 3.2.2); architectural decomposition is recommended before deployment.
Layer 3 — Public-evidence confidence diagnostic
| Component | Score | Basis |
|---|---|---|
| Pc — Public provenance evidence | 0.20 | Below the 0.25 anchor. The brief identifies the commit, the five file paths, the payload size, the trigger mechanisms, and the affected products, but no deployment owner, agent version, tool manifest, credential inventory, identity policy, or evaluation artefact for any specific developer environment. No AIBOM or equivalent record exists for the assessed configuration. |
| Ec — Public evaluation coverage | 0.32 | coverage 0.32 (7 of 22 applicable sub-metrics) × independence 1.00 × fidelity 1.00. No Full, Standard, or Lite pathway is claimed for a retrospective article. |
| Tf — Public-evidence freshness | 0.21 | Evidence dated 2026-06-05; age 135 days on the workpaper reference date. Components: T_behavior 0.21 · C_event 0.35 · T_containment 0.36 · C_behavior 0.40 · T_calendar 0.60 · C_monitor 0.65 · C_evidence 0.85. Binding term: T_behavior. BAW applies: the checklist item for mutable behavioural state is met because repository-local configuration and always-applied rules change the agent's startup behaviour and persist across sessions in the workspace. C_monitor 0.65 — nothing in the assessed environment detected the configuration-only commit or the hook execution; AID-D-004.003 has to be recommended to start alerting on suspicious configuration changes. C_event 0.35 — the major row applies: a confirmed critical-invariant violation, namely a credential harvester launched from repository-local configuration inside a credential-bearing developer session. C_behavior Band 0 (0.40) — no canary set, no registered invariants, and no maintained drift baseline are evidenced for the agent's activation behaviour, which is the specification's worst-case default band. C_evidence 0.85 — the class remains open: the brief's remediation is a change of default trust posture across several products rather than a shipped fix. |
Public-evidence ACI = (Pc × Ec × Tf)1/3 = 0.24 — diagnostic status: Invalid as assessment-of-record evidence. It describes the evidence available to this case study, not the assurance of the underlying system, and is not inserted into the normalized-assurance scenario ERS.
Indicative ERS — normalized-assurance scenario
Published CVSS beside indicative ERS
Each published CVSS record is shown exactly as its scorer published it, one per vulnerability record, with the version, metric group and vector when stated, plus its source and access date. Records are never combined or inferred from a CVE's existence.
INDICATIVE ERS · NORMALIZED-ASSURANCE SCENARIO
7.9 midpoint, interval 3.9–10.0; High scenario band; ACI fixed at 1.00. The published CVSS records do not enter this calculation.
PUBLISHED CVSS
CVSS — no applicable published score verified.
CVSS describes an individual vulnerability as its scorer published it. Indicative ERS describes the assessed AI deployment under the normalized-assurance scenario, so the two values are not direct equivalents and neither replaces the other.
AIDEFEND defences → AITBM sub-metrics
Identifiers are quoted as they appear on the AIDEFEND in Action brief or in the AIDEFEND SecureFlow defense map (audited AIDEFEND dataVersion 2026.10.15); the sub-metric mapping is AITBM's own, from the specification's AIDEFEND tables reconciled at catalogue data version 2026.10.15. AIDEFEND renumbers identifiers between releases, so the data version travels with every mapping and neither side's IDs should be cited without one. A mapping identifies a possible evidence route; a recommendation does not prove that the control was implemented or effective and receives no scoring credit by itself.
| Technique | Defence | Priority | Evidences |
|---|---|---|---|
| AID-H-021.001 | Client-Side Configuration EnforcementAIDEFEND dataVersion 2026.10.15. Scanning repository-local Claude Code, Gemini CLI, and Cursor configuration before commit or checkout acceptance — and enforcing policy against SessionStart command hooks, always-applied execution instructions, backdated skip-CI commits, and unexpected executable references — is the Ro-5 and Cn-8 admission control the disclosed path lacks. The brief states this control does not cover the separate non-AI VS Code folder-open route, which this workpaper also excludes. | Very High | Cn-2 Cn-5 Cn-9 |
| AID-H-021.002 | Runtime Integrity Enforcement (Signed Configurations)AIDEFEND dataVersion 2026.10.15. Rejecting unsigned local configuration overrides at agent startup, and requiring approved signed configuration before a hook or rule can run, is the Cn-5 control whose absence lets a repository define the agent's directive. | Very High | Cn-2 Cn-5 Cn-9 |
| AID-D-004.003 | Runtime Configuration & Policy Drift Detection and MonitoringAIDEFEND dataVersion 2026.10.15. Alerting on configuration-only commits that suppress CI or introduce new automatic execution paths is the C_monitor evidence the assessed environment does not produce; it is detection, not enforcement. | High | Ro-5 Tr-3 Cn-7 Cn-9 |
| AID-I-001.002 | MicroVM & Low-Level SandboxingAIDEFEND dataVersion 2026.10.15. Opening untrusted projects inside a microVM or user-space-kernel boundary with no developer home-directory credentials and no host write paths is the Cn-1 containment boundary that would bound Cp; the brief notes this project-level boundary contains the agent hooks and the excluded VS Code task alike. | High | Pr-2 Cn-7 |
| AID-H-025.001 | Pre-Execution Static Analysis & Dangerous Construct BlockingAIDEFEND dataVersion 2026.10.15. A release-pinned static-analysis gate over the exact .github/setup.js bytes is marked 'Partial' by the brief for the reason that governs its scoring role here: it must fail closed when a 4.6 MB obfuscated artefact cannot be analysed, and static analysis alone cannot prove such an artefact safe. | Partial | Cn-3 |
WHAT THIS CASE TEACHES
Miasma moves supply-chain execution from package installation to project open, and AITBM records that as an identity failure as much as a containment one: Cn-5 scores 0.00 because nothing bound the agent's operating directive to a verified source, so a repository rather than the operator defined what the agent would do at startup. The non-AI VS Code route is deliberately excluded from the assessed system — the brief's own defence descriptions disclaim coverage of it, and folding it in would have mixed a conventional IDE trust boundary into an AI-agent score.
Sources: AIDEFEND in Action — Miasma Targets Repository-Local Trust in Claude Code, Gemini CLI, Cursor, and VS Code · Primary source — Miasma Worm Hits Microsoft Again: Azure Functions Action and 72 Other Repositories Disabled (StepSecurity, 2026-06-05) · AIDEFEND SecureFlow — Miasma Repository Settings Trigger Credential Harvester
AIDEFEND SecureFlow attack-flow cross-reference
The same incident is modelled step by step, with ATLAS technique labels and AIDEFEND defense mappings, in AIDEFEND SecureFlow. The flow is listed for navigation only; this record's evidence and scores come from the sources cited above. Open SecureFlow.
- Miasma Repository Settings Trigger Credential Harvester (same incident · AIDEFEND curated research flow)ATLAS techniques: AML.T0010.001, AML.T0011, AML.T0051.001, AML.T0050, AML.T0055