{"data":{"id":"1167608d-86c2-4493-af42-d0bf7df727b4","title":"Who approves the files that control your AI coding assistant?","summary":"StepSecurity revisited the June Miasma campaign in an October 8 analysis of agent-skill distribution. The campaign planted AI-tool and editor configuration in a Microsoft repository without modifying application source, aiming to trigger credential harvesting through developer tooling. The source argues that merging such configuration can distribute execution instructions to everyone working in the repository.","solution":"N/A -- no mitigation discussed in source.","labels":["security","industry"],"sourceUrl":"https://www.csoonline.com/article/4242707/who-approves-the-files-that-control-your-ai-coding-assistant.html","publishedAt":"2026-11-02T09:00:00.000Z","cveId":null,"cweIds":null,"cvssScore":null,"cvssSeverity":null,"severity":"medium","attackType":["supply_chain"],"issueType":"news","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":["Microsoft"],"affectedVendorsRaw":["AI coding assistant configuration files","Claude Code"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":null,"epssScore":null,"epssCheckedAt":null,"kevDateAdded":null,"advisoryAliases":null,"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":null,"disclosureDate":"2026-11-02T09:00:00.000Z","fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity"],"aiComponentTargeted":"agent","llmSpecific":false,"classifierConfidence":0.8,"researchCategory":null,"atlasIds":["AML.T0010"]}}