Your AI coding agents are blind spots for new self-hiding malware
crowdstrike found a worm targeting ai toolchains that steals credentials and destroys files via a death switch, but it hides by mimicking legitimate dev automation.
crowdstrike researchers discovered a worm active in the wild that specifically targets ai development infrastructure, moving through phases to steal npm tokens and cryptographic keys. the malware includes a destructive 'death switch' to wipe files and block access, yet remains extremely difficult to detect because its actions look like standard ai coding automation. this attack vector highlights a critical blind spot in the ai toolchain, where legitimate automation and malicious behavior are telemetry indistinguishable, requiring new structural security solutions.