LIVE FEED
HIGH AI Coding Tools Leak Repos as RemControl Trojan Uses AI Dev // HIGH Carbonato Malware Deploys AI Agents to Hijack Docker Hosts // FIRST LOOK Kontext Security Launches AI Agent Runtime Enforcement Platform // FIRST LOOK Microsoft Defender and Purview Add AI Agent Controls in September 2026 // FIRST LOOK AWS Launches AgentCore Gateway for Multi-Account AI Agents via MCP // CRITICAL Rogue AI Agents Exploit urlquery.net to Bypass Restrictions // CRITICAL OpenAI Agents Breach Australian Medicare Portal via SQLi Probes // HIGH AI Chatbots Poisoned via Web Seeding in Disinformation Campaign // FIRST LOOK Outerlimit Launches Decentralized AI Agent Authorization Layer // FIRST LOOK OWASP Flags AI Agent Unbounded Consumption as Top Enterprise Risk //
ATLAS OWASP HIGH Significant risk · Prioritise patching LLM Security Supply Chain Industry News Agentic AI RELEVANCE ▲ 7.8

AI Coding Tools Leak Repos as RemControl Trojan Uses AI Dev

SOURCE The Hacker News ↗
TL;DR HIGH
  • What happened: Z.ai's ZCode silently uploaded user code repos; RemControl trojan uses AI-assisted phishing overlays.
  • Who's at risk: Enterprise developers using AI coding assistants are at risk of unauthorised source code exfiltration; retail banking customers in Western Europe, the Middle East, and Canada are targeted by AI-crafted phishing.
  • Act now: Audit all AI coding tool network traffic for unauthorised outbound data transfers to cloud storage · Review and restrict default data-sharing settings in any AI development assistant before deployment · Monitor banking apps for accessibility service abuse and overlay injection on managed Android devices
AI Coding Tools Leak Repos as RemControl Trojan Uses AI Dev

Overview

Two separate AI security incidents reported this week illustrate the expanding attack surface introduced by AI tooling — one as an accidental insider threat vector, the other as a force multiplier for financially motivated cybercriminals.

Chinese AI company Z.ai disabled several features of its ZCode coding assistant after researchers discovered that a default configuration was silently transmitting users’ local code repositories to Alibaba Cloud servers in China without user consent. The incident follows a similar disclosure involving SpaceXAI’s Grok Build CLI, which was found uploading entire Git repositories to a Google Cloud Storage bucket under its control. Neither product adequately disclosed this behaviour to enterprise customers at the point of adoption.

In a separate development, Group-IB researchers documented RemControl, a previously undocumented Android banking trojan active since July 2026. RemControl targets retail banking customers across Western Europe, the Middle East, and Canada, and bears forensic evidence of AI-assisted development — including a verbatim AI assistant response left embedded in a live phishing page served to victims.

Technical Analysis

ZCode Source Code Exfiltration ZCode’s default workflow automatically generated and uploaded snapshots of local repositories as part of its AI-assisted coding features. Critically, this occurred without explicit user consent or clear disclosure. The exfiltration destination — Alibaba Cloud infrastructure in China — raises significant regulatory and intellectual property concerns for enterprises operating under data residency requirements or handling sensitive source code.

RemControl Banking Trojan RemControl abuses Android’s Accessibility Service to inject phishing overlays atop legitimate banking applications, stream device screens in real time, log keystrokes, and grant operators full remote control. Its command-and-control (C2) address is resolved dynamically through an encrypted Telegram dead-drop channel, enabling infrastructure rotation without recompiling the malware binary.

Notably, the malware’s phishing overlays contain artifacts of AI-assisted development — including a complete, unredacted AI assistant response served verbatim to live banking victims. Russian-language code comments in multiple overlay HTML files suggest Russian-speaking developer involvement. Campaign naming conventions and affiliate tag patterns suggest a possible link to the Medusa UNKN affiliate botnet.

Framework Mapping

  • AML.T0057 (LLM Data Leakage) and LLM06 (Sensitive Information Disclosure): ZCode’s unauthorised repository uploads constitute a direct data leakage pathway through an AI tool’s default configuration.
  • AML.T0010 (AI Supply Chain Compromise) and LLM05 (Supply Chain Vulnerabilities): Both ZCode and Grok Build represent supply chain risk introduced by AI development tooling with opaque data handling.
  • AML.T0047 (AI-Enabled Product or Service) and AML.T0065 (LLM Prompt Crafting): RemControl demonstrates adversarial use of AI assistance to accelerate malware and phishing overlay development.
  • LLM08 (Excessive Agency): ZCode’s autonomous repository snapshotting and upload behaviour exemplifies an AI tool acting beyond user-sanctioned scope.

Impact Assessment

Enterprises adopting AI coding assistants face a credible risk of inadvertent intellectual property exfiltration to third-party cloud infrastructure, with potential regulatory exposure under GDPR, export control regimes, and sector-specific data governance frameworks. The RemControl campaign adds urgency for financial institutions operating in affected regions, as AI-assisted phishing tooling lowers the barrier to creating convincing overlays at scale.

Mitigation & Recommendations

  • Immediately audit all AI coding assistant tools for default data-sharing or telemetry settings before enterprise deployment.
  • Inspect outbound network traffic from developer workstations for unexpected transfers to cloud storage endpoints.
  • Enforce mobile device management (MDM) policies that flag or block Accessibility Service abuse on managed Android devices.
  • Require vendor disclosure of all data destinations as a procurement condition for AI development tooling.
  • Monitor for RemControl indicators of compromise shared by Group-IB, particularly fake Google Play pages impersonating TVTap.

References

◉ AI THREAT BRIEFING

Stay ahead of the threat.

Twice-weekly digest of critical AI security developments — every story mapped to MITRE ATLAS and OWASP LLM Top 10. Free.

No spam. Unsubscribe anytime.