AI coding agents are no longer just a productivity tool — they have quietly become a new attack surface. A technique now being used by cybercriminals involves creating legitimate-looking GitHub repositories that contain hidden instructions designed to manipulate AI coding assistants into executing malicious code. For small and medium businesses that have started using AI-powered development tools, this is not a theoretical risk. It is a live threat worth understanding right now.
How the Attack Actually Works
Here is the core idea in plain terms. AI coding agents — tools like GitHub Copilot, Cursor, or similar assistants — are often given the ability to read files, browse repositories, and run code on your behalf. Attackers are exploiting this by crafting repositories that look completely clean to a human reviewer but contain carefully hidden instructions in places the AI reads, such as configuration files, README documents, or embedded metadata. When the AI agent processes these files as part of its workflow, it follows those hidden instructions and executes malicious commands on the developer's machine — often without any obvious warning.
This style of attack is sometimes called prompt injection, and it is particularly dangerous because it bypasses the human instinct to spot suspicious files. The repository passes a visual check. There is no obvious red flag. The malware only activates when the AI takes the wheel.
Why SMBs Are Especially Exposed
Large enterprises often have dedicated security teams reviewing every tool their developers use. Most small and medium businesses do not have that luxury. If your team has adopted AI coding assistants to move faster — and most teams have — the chances are high that nobody has audited exactly what permissions those tools have been granted or what repositories they are pulling from.
The consequences of a successful attack like this can be severe. Malware executed on a developer's machine can steal credentials stored in browsers or code editors, harvest API keys and database passwords saved in project files, and exfiltrate sensitive business data. That information frequently ends up for sale on dark web markets within hours. At Breachrr, we monitor those markets continuously, and the volume of stolen developer credentials appearing in infostealer dumps has grown significantly through 2025 and into 2026. This attack technique is one of the reasons why.
What You Should Do Right Now
The first step is awareness. Make sure anyone on your team using AI coding tools understands that these assistants can be manipulated by malicious content in external repositories. Treat third-party code sources with the same caution you would apply to an email attachment from an unknown sender.
Second, audit the permissions granted to your AI development tools. Most of these tools do not need the ability to execute shell commands or access production credentials. Restrict what they can do to the minimum required for the task. This is sometimes called the principle of least privilege, and it matters more than ever when AI agents are in the loop.
Third, check whether your developers' credentials and API keys have already been compromised. Infostealer malware has been harvesting developer environments for years, and many businesses do not know their tokens or passwords are already circulating on dark web forums. If a developer's machine was previously infected — even briefly — those credentials may still be active and at risk.
Finally, look at what your organisation has exposed publicly. Breachrr scans breach databases, infostealer dumps, dark web markets, public code repositories, and domain infrastructure to surface risks that most businesses never see coming. The GitHub-based attack described here often succeeds because credentials and environment variables are already exposed somewhere they should not be, making the eventual malware payload even more damaging.
Staying Ahead of AI-Enabled Threats
The use of AI coding agents is not going to slow down — and neither is attacker creativity in exploiting them. The businesses that come out ahead will be the ones that treat AI tools as part of their security perimeter, not outside of it. Understanding what your tools can access, what has already been exposed, and where your credentials are appearing online is the foundation of that protection.
If you are not sure where your business stands, start with a free audit at breachrr.com/audit. It takes minutes and shows you exactly what attackers can already see about your organisation.
Want to see if your company is exposed?