Malware posing as a Solana starter kit is built to infect AI coding agents
Security firm Air Security found a GitHub repository posing as a Solana starter kit that is built to catch AI coding agents. Its only setup step is a command that downloads a program from an outside domain. Air Security says the repository is the top result when an agent searches for such a kit, and that the program is a legitimate remote-control tool set up to give an attacker control of the machine, including crypto wallets. The download address was offline when checked, and Air Security does not report any agent or victim actually infected. The reporting does not say how an affected agent would be approved to run the command.
Getting the agent to select and follow the malicious repository was enough.
Alan's takeA coding agent that blindly follows any README is the same as an unvetted download button. Any junior developer would pause. We keep handing agents work that assumes basic judgment they don’t reliably have.