The Miasma Worm Specifically Targeted AI Coding Tools - Have You Changed Your Setup

[KnotKnull]

The technical detail that distinguishes the Miasma worm is worth understanding if you use AI coding assistants professionally. The attack planted a .claude/settings.json file containing a SessionStart hook, meaning the credential harvesting payload fired automatically when a developer opened the repository in Claude Code. Similar files targeted Gemini CLI, Cursor and VS Code. The attack did not require running anything manually.

Has this changed how you have configured your tools? What permissions do your coding assistants actually have, and has anyone audited their setup since this came out?

[Amber_44]

Audited my Claude Code permissions immediately after reading the StepSecurity write-up. It had broader filesystem access than I had intentionally granted. The default settings are generous in ways not obvious from the onboarding