# chaindrop-opening-a-repository-is-enough-to-execute-attacker-code: ChainDrop: Opening a Repository Is Enough to Execute Attacker Code

> ChainDrop: Opening a Repository Is Enough to Execute Attacker Code is a critical-severity remote code execution issue in Opening a Repository Is Enough to Execute Attacker Code, an AI agent. It has been exploited in the wild.

- **Canonical URL:** https://catalog.anomity.ai/vuln/chaindrop-opening-a-repository-is-enough-to-execute-attacker-code
- **Aliases:** ti-066
- **Severity:** critical
- **Attack type:** Remote code execution, Supply chain compromise, Malware
- **Component:** Opening a Repository Is Enough to Execute Attacker Code (AI agent)
- **Exploited in the wild:** yes
- **Published:** 2026-08-04
- **Last verified:** 2026-11-01
- **JSON:** https://catalog.anomity.ai/api/entries/vuln/chaindrop-opening-a-repository-is-enough-to-execute-attacker-code

## Summary

Pillar Security and Microsoft threat intelligence both documented ChainDrop, a self-propagating supply chain compromise where merely opening a repository is sufficient to run attacker code, with no build step and no explicit consent. Once running it spreads onward, which is what turns a single poisoned repository into a worm rather than a single victim.

## Affected versions

| Affected | Fixed in |
| --- | --- |
| see advisory | no fixed version listed |

## Am I affected by this vulnerability?

You are affected if Opening a Repository Is Enough to Execute Attacker Code is installed or configured on a machine. Check the references for the exact versions.

## How do I fix it?

Disable automatic execution of workspace-scoped configuration when opening untrusted repositories, and keep folder-trust prompts enabled rather than blanket-trusting parent directories. Review any repository opened from an untrusted source for editor and agent config that runs on open.

## How do I find every machine running Opening a Repository Is Enough to Execute Attacker Code?

Anomity inventories the AI agents, MCP servers, IDE extensions and skills on each developer device, so you can see which machines run Opening a Repository Is Enough to Execute Attacker Code and which version, then enforce a policy on it.

## References

- article: https://www.microsoft.com/en-us/security/blog/2026/08/04/chaindrop-supply-chain-compromise-anatomy-self-propagating-worm/

## Related vulnerabilities

- [GHSA-632h-h47v-g4x4](https://catalog.anomity.ai/vuln/ghsa-632h-h47v-g4x4) — high
- [plugin4shell-sha-pinning-bypass-gives-zero-click-rce-across-claude-code](https://catalog.anomity.ai/vuln/plugin4shell-sha-pinning-bypass-gives-zero-click-rce-across-claude-code) — critical
- [mandiant-hijacked-ai-coding-assistant-session-deploys-shai-hulud-across](https://catalog.anomity.ai/vuln/mandiant-hijacked-ai-coding-assistant-session-deploys-shai-hulud-across) — critical
- [keyv-cacheable-npm-worm-writes-auto-run-hooks-into-claude-settings-json](https://catalog.anomity.ai/vuln/keyv-cacheable-npm-worm-writes-auto-run-hooks-into-claude-settings-json) — critical
- [asyncapi-npm-packages-backdoored-with-miasma-malware-framework](https://catalog.anomity.ai/vuln/asyncapi-npm-packages-backdoored-with-miasma-malware-framework) — critical
- [teampcp-injects-malware-into-microsoft-linked-github-repositories](https://catalog.anomity.ai/vuln/teampcp-injects-malware-into-microsoft-linked-github-repositories) — high

---

Source: Anomity Security Database (https://catalog.anomity.ai/vuln). Detect affected AI tools on developer devices: https://anomity.ai/?utm_source=catalog&utm_medium=vuln-md&utm_campaign=chaindrop-opening-a-repository-is-enough-to-execute-attacker-code