Reported supply-chain campaign using a malicious extension to spawn coding agents

Source Summary

What It Contains

This is the user-provided summary of a campaign where a compromised CI pipeline allegedly led to a malicious IDE extension that launched coding agents with permissive flags and prompted them to exfiltrate credentials.

Extracted Claims

• Attackers can use trusted developer tooling to spawn local coding agents instead of traditional malware payloads.
• A malicious extension can turn agent autonomy into a credential-theft path.
• Developer workstation protections and action gates matter for coding-agent abuse.

Evidence Quality

Useful threat pattern, but currently only preserved here as user-supplied post text. I was not able to retrieve the exact primary Pillar report URL from the short link during this pass.

Follow-Up

• Add the original Pillar report if you locate the stable public article.