In the wild
Realized harm
GlassWorm: self-propagating VS Code / OpenVSX extension worm hidden in invisible Unicode with Solana-based C2
AIR-2025-0150 AIR record · 2025-10-glassworm-openvsx
A real party was affected. This incident caused actual consequences, not a demonstrated capability.
From the supporting source
The malware is invisible. Not obfuscated. Not hidden in a minified file. Actually invisible to the human eye.koi.ai
The record
Disclosed
2025-10-18
Occurred
2025-10-17
Vendor
Eclipse Foundation (OpenVSX) / Microsoft
Product
OpenVSX and Microsoft VS Code Marketplace extensions (e.g. CodeJoy)
Risk domain
Access control and permissions › Credential theft
Also touches
Privilege escalation, Supply chain vulnerabilities
System type
Generative model
Who acted
AI was the target (contested) — a conventional extension worm stealing credentials in the AI tooling ecosystem
Attack surface
Skill / plugin
Autonomy level
Assistant
Initial vector
Stolen publisher credentials then malicious extension update
Impact type
Credential theft, Crypto theft, Persistence, Remote control, Supply chain compromise, Financial theft
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI03 – Identity and Privilege Abuse
- MITRE ATLAS
- AML.T0012 – Valid Accounts
- NIST AI RMF
- MEASURE 2.7
- EU AI Act
- Article 13
- ISO/IEC
- TR 24028; 42001; 23894
- AIUC-1
- B. Security
- Scope
- tool failure
- Mitigation
- Use secure credential storage; Implement short-lived tokens.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
15 extensions identified across both marketplaces; ~35,800 installations
Capability abused
Defense & remediation
Recorded defense
marketplace review and human code review
Guardrail kinds
Unknown
Guardrail outcome
Silent
Fix shipped
extensions removed in waves; further waves observed later
Taxonomy & references
Curator notes
Koi Security. Uses Unicode variation selectors that render as nothing in editors but execute in JavaScript. Steals npm, GitHub, OpenVSX and Git credentials and uses them to auto-infect further packages, hence self-propagating. Targets 49 crypto wallet extensions, deploys a SOCKS proxy and hidden VNC. C2 reads base64 payload URLs from Solana transaction memos, with a Google Calendar event and 217.69.3.218 as fallbacks. BORDERLINE FOR THIS CORPUS: it is the developer-extension supply chain that AI coding agents run inside, but the worm itself is not agent-specific. Also reported as: 'GlassWorm: self-propagating VS Code / OpenVSX extension worm hidden in invisible Unicode'.
Supporting sources
Cite as
Enkrypt AI. "GlassWorm: self-propagating VS Code / OpenVSX extension worm hidden in invisible Unicode with Solana-based C2". AIR, AIR-2025-0150. https://agentincident.vercel.app/i/AIR-2025-0150/ (accessed 2026-10-19).