【AI前沿】Microsoft's Dozens of Open Source AI Tools Suffer Supply Chain Attack,大量 Developer Credentials Stolen

AI NEWSLatest AI NewsArticle ContentMicrosoft’s Dozens of Open Source AI Tools Suffer Supply Chain Attack,大量 Developer Credentials StolenPublished in Latest AI NewsTime :Jun 9, 2026Read :3minuteMicrosoft temporarily cut off access to at least 70 open-source projects hosted on GitHub following a cyberattack. Hackers injected malicious software into the code through a “supply chain attack,” aiming to steal users’ passwords and sensitive credentials when they open the compromised tools in AI coding applications such as Claude Code, Gemini CLI, and VS Code.Ben Hope, a Microsoft spokesperson, confirmed that the company temporarily removed the affected repositories during the investigation, and some code repositories have been restored after review. This is the second known security vulnerability incident that Microsoft’s open-source projects have faced in recent weeks. In mid-May this year, its open-source tool Durable Task was previously hacked, and the security agency OpenSourceMalware noted that this event marked a “second invasion” of the project.At a time when large AI models and open-source ecosystems are deeply integrated, this intrusion into a major resource library once again sounds a safety alarm. With the rapid increase in the adoption of AI coding assistants, the open-source supply chain has become the new main battlefield for cyber warfare. How to build more resilient code review and security protection mechanisms is a common challenge that tech giants need to address in the AI era.