Breaking

Researchers Show AI Coding Agents Can Be Steered to a Fake Solana Starter Kit on GitHub

October 30, 2026 at 19:17 EDT

Security
AI Agents
Software Dev & Coding

AIR Research Lab says a fake Solana starter kit hosted on GitHub ranked first when AI coding agents searched for one, and in its demonstration, Anthropic's Claude Code selected the malicious repository and ran its only installation step, a one-line PowerShell command.

Supply-chain risk · AI coding agents

A fake Solana starter kit ranked first, and an AI agent ran its install command

In the researchers' demonstration, a malicious GitHub repository topped search results for a Solana starter project. Claude Code selected it without further prompting and executed the single one-line PowerShell install step.

Search rank of the fake kit for an AI agent

Install command the project required

Genuine, signed components installed by that one command

One command, many components

Each block is one unit: 1 install command vs 13 signed components.

install command

signed components

Signed, genuine-looking components suggest the payload was built to pass basic trust checks.

How the lure worked at machine speed

Step 1

Agent searches

Asked for a Solana starter

→

Step 2

Continue reading

The rest of this article is for AI News Blitz readers. Choose an option below to keep reading.