In the wild
Realized harm
Hades: one committed config file hijacks 14+ AI coding agents on repo open, harvesting cloud and registry credentials at scale
AIR-2026-0133 AIR record · 2026-06-hades-agent-config-hook-campaign
A real party was affected. This incident caused actual consequences, not a demonstrated capability.
From the supporting source
Opening the repo in VS Code fires the `folderOpen` task. Opening it in Claude Code or Gemini fires the `SessionStart` hook.pillar.security
The record
Disclosed
2026-06-10
Occurred
2026-06-03
Vendor
multiple
Product
Claude Code, Gemini CLI, Cursor, VS Code, Copilot, Cline, Aider, Amazon Q, Cody, Continue and others
Risk domain
Tool misuse › Supply chain vulnerabilities
Also touches
Credential theft, Data exfiltration channels
System type
Generative model
Who acted
Agent acted — the agents ran the config hooks on repo open and harvested credentials
Attack surface
Coding agent
Autonomy level
Semi-autonomous
Initial vector
Malicious repository config file
Impact type
Credential theft, Supply chain compromise, Data exfiltration
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI04 – Agentic Supply Chain Vulnerabilities
- MITRE ATLAS
- AML.T0040 – AI Supply Chain Compromise
- NIST AI RMF
- MAP 4.1
- EU AI Act
- Annex III §2
- ISO/IEC
- TR 24028; 42001; 23894
- AIUC-1
- B. Security
- Scope
- tool failure
- Mitigation
- Scan dependencies and container images for vulnerabilities; Use trusted sources.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
73 Microsoft repositories, ~37 PyPI bioinformatics packages, mantine-datatable and others; 55+ exfiltration repos holding 88 encrypted credential dumps
Capability abused
Defense & remediation
Recorded defense
none - hooks execute on session start / folder open with no trust prompt
Guardrail kinds
None
Guardrail outcome
Not applicable
Fix shipped
no CVE; mitigation requires trust prompts on auto-execution and friction on agent git operations
Taxonomy & references
Curator notes
Pillar Security (Ariel Fogel). Observed in the wild 2026-06-03 to 2026-06-09; successor to the 2025 Shai-Hulud worm. Steals GitHub PATs, AWS/GCP/Azure creds, npm/PyPI tokens, SSH keys and Kubernetes tokens; reads process memory for unmasked secrets and forges package provenance via OIDC/Sigstore. Incident-response caveat from the writeup: 'Revoking the token first on a host that may still be infected can set off the wiper.' Related to but distinct from 2026-08-chaindrop-agent-hook-campaign.
Supporting sources
Cite as
Enkrypt AI. "Hades: one committed config file hijacks 14+ AI coding agents on repo open, harvesting cloud and registry credentials at scale". AIR, AIR-2026-0133. https://agentincident.vercel.app/i/AIR-2026-0133/ (accessed 2026-10-19).