Cases › security breach › LR-2026-0304
SolanaCry fake GitHub repo tricks AI coding agents into installing NetSupport RAT
Preliminary Why: Publisher not yet named · subject to change
Developing: a major or severe case captured in the last 72 hours. Later changes are logged on the corrections page.
Severity major: A source states that the scope is unbounded. The malicious repository could reach any developer whose AI coding agent surfaced it, installing remote-access malware and potentially exposing cryptocurrency wallets, an unbounded scope.
Earliest source we hold 2026-10-30 · Captured by AI Risk Wire 2026-11-01 00:47 UTC
A fake GitHub repository posing as a Solana starter kit, SolanaUpdateTools/solana-starter-kit, ranked first in search results and its README told AI coding agents to run a PowerShell command that downloaded and executed a 21 MB dropper in memory.
Risks this incident falls under
| Risk | Role | NIST AI 600-1 | Incidents | Last 6 quarters |
|---|---|---|---|---|
| Hidden instructions hijack the agent | Primary | Information Security | 21 | |
| AI used to run a cyber attack | Also | Information Security | 38 | |
| AI system attacked or breached | Also | Information Security | 1 |
Sorted by rule from the case's fields; not yet read from the sources.
Control failure chain
L1 · ModelProvider not namedModel provider
Sources not yet read for controls.
Model version not linked to a model card.
L2 · HarnessAI coding agentsAgent framework vendor
Sources not yet read for controls.
Other controls for this risk at this layer, not yet read for: Outside content treated as data, not instructions, Prompt-injection detection, Confirmation after untrusted input, Validation of tool inputs and outputs, Tool allow-list.
L3 · ApplicationDeployer not namedDeployer
Sources not yet read for controls.
Other controls for this risk at this layer, not yet read for: Human approval for high-impact actions, Least-privilege access for the agent, Segmentation of agent components, Alerts on unusual tool use.
L4 · Infrastructure / targetOrganisation hit
Sources not yet read for controls.
HeldFailedGot aroundMissingNot mentionedNot read yetAttacker's ownOrder: model · harness · application · target
The same controls in other incidents of this risk
| Control | Layer | Here | Held elsewhere | Did not hold elsewhere |
|---|---|---|---|---|
| Tool allow-list | L2 Harness | Not read yet | ||
| Confirmation after untrusted input | L2 Harness | Not read yet | ||
| Outside content treated as data, not instructions | L2 Harness | Not read yet | ||
| Prompt-injection detection | L2 Harness | Not read yet | 1 | |
| Validation of tool inputs and outputs | L2 Harness | Not read yet | ||
| Least-privilege access for the agent | L3 Application | Not read yet | ||
| Human approval for high-impact actions | L3 Application | Not read yet | 4 | |
| Segmentation of agent components | L3 Application | Not read yet | ||
| Alerts on unusual tool use | L3 Application | Not read yet |
Risk grouping: Not yet classified
No source we hold states: who caused it, intended or not, before or after release, the ai's part.
The story
What the sources state
- Cause hostile input carried instructions
No source states: when it happened, when it was found, how many records were exposed, the direct loss, a count of the other parties affected, any court case, what set it off.
Show every field, with its source and grade
The AI system
What happened
Impact
Context
Notes on gaps
No source states whether any agent actually executed the command, so harm is potential rather than confirmed.
LR-2026-0304 · version 2 · published 2026-11-01 after automatic checks; not yet checked field by field by a person · changes to this case · JSON