Air Security says malware posing as a Solana starter kit on GitHub is built to infect AI coding agents that follow its install instruction

What happened

Air Security reported on October 29 that a GitHub repository posing as a Solana starter kit, created in November 2025, carries malware aimed at AI coding agents. The README gives one install step, a PowerShell command that downloads a payload from an outside domain. Air Security says the repository is the top result when an agent searches for a Solana starter kit, and that an agent which picks it and runs that command would install NetSupport Manager, a legitimate remote-administration tool set up here to give an attacker control of the machine, including crypto wallets on it. The payload address was offline when Air Security checked, so it recovered the file from a web archive. Air Security reports no agent or victim actually infected.

Why it was a problem

A coding agent that follows a README treats text from an anonymous repository as an instruction to run code with the developer's access to wallets, keys and accounts. Air Security recovered the payload itself, so the repository and its contents are established. That any agent ran it is not, and Air Security sells agent-protection tooling and bases its link to earlier NetSupport campaigns on its own analysis.

How SAG could have helped

Under the assumptions below, a developer's coding agent would run as a defined piece of work, for example building a Solana project, with declared steps such as searching the web, reading a repository, installing dependencies from named registries and running named build commands. A person grants that work and names the commands and download sources each step may use. Running a PowerShell command that fetches a program from an unlisted domain is not one of those operations and targets, so it would be refused before it was sent, however highly the repository ranked in search and whatever its README said. Permission attaches to the exact operation and target a person granted, so text the agent read cannot add a download source. Installing remote-control software and writing a startup entry would fall outside the grant as well. This holds only where the governed path is the sole way the agent can run commands; an agent that can open its own shell is not covered. SAG does not judge whether a repository is malicious, detect malware or warn the developer. It limits what a steered agent is permitted to do.

Assumptions we must make

• The organization defines each coding agent's work as declared steps, and a person grants the commands and download sources every step may use, with no step that runs arbitrary shell text taken from a repository. (Assumed)
• Every command the agent runs, including installs and shell calls, passes through the company's governed path, and the agent holds no separate shell or credentials that bypass it. Public reporting does not say how affected agents run commands. (Unknown)
• Any step that installs software from a source not already granted waits for a named person's decision on that instance, and that person is reachable when the agent asks. (Assumed)

Classification

Category

Disclosed vulnerability

Section

Agent governance

Is update

No

Rank

1

Event date text

Repository created November 2025; payload recovered from a web archive; no infected agent reported

Publication date text

2026-10-29

Governance analysis

Intended task

Build a Solana project by searching the web for a starter kit and following its setup instructions.

Action taken or attempted

Attempted by design: the agent selects the top-ranked repository and runs the README's PowerShell command, which downloads and runs a payload from an outside domain. No agent is reported to have done so.

Access

Web search, repository contents, and a shell on the developer's machine with the developer's access to files, keys and wallets.

Authority boundary

The developer's request to build a Solana project, versus an install command written by an anonymous repository author.

Harm or near miss

Potential remote control of the developer's machine and its crypto wallets. No confirmed victim or infected agent.

Control failure

Text from an untrusted repository would be followed as an instruction to run a download-and-execute command with no check on the source.

Control categories

Untrusted input handling, Action time authorization, Human approval

Diagnosis confidence

Supported inference

Preventive or detective control

An allowlist of download sources and commands for coding agents, with a person's approval before software is installed from a new source.

Approval path

Not established

Authority comparison

The agent could run any command a README told it to, including downloading and installing programs, whereas a new engineer is not allowed to install software from an unvetted source on their first day.

Timeline

• Repository created: November 2025
• Air security publishes findings: 2026-10-29

Sources

• air.security

Notes

From sources

• The repository, its README install command and the recovered payload contents are described by Air Security.
• The payload address was offline when Air Security checked.
• The payload installs NetSupport Manager components and sets a startup entry, per Air Security.

Inferred

• An agent that ran the README command would install the remote-control tool (follows from the recovered payload).

Not established

• Whether any AI agent selected the repository or ran the command in practice.
• How many victims, if any.
• Who operates the campaign; the link to earlier NetSupport campaigns is Air Security's own assessment.

Disclaimers

• The SAG section is an architectural counterfactual under the stated assumptions. It is not a claim that Seampoint software operated in the reported environment.
• Reporting is based on public statements and press coverage. Sources may be incomplete, disputed or later corrected, and third-party allegations are unconfirmed unless the operator confirms them.
• SAG is described here by reference to Seampoint's work-class specification, which is an open review draft. It is not an adopted standard, and no production deployment has been qualified against it.