Coder's own delivery infrastructure was hijacked to serve credential-stealing modules from the real registry.coder.com. No CVE, no poisoned package, nothing for a scanner to match.
Full advisory deck
Coder
Cloudflare
AWS
GCP
Azure
Anthropic
OpenAI
GitHub
GitLab
BitbucketDomain registered
coder-infra.com is registered
Rogue IPs serve malware
Unauthorised IPs added to the registry.coder.com Cloudflare pool
Serving stops
Roughly a 14-hour window
Advisory + patched builds
Coder publishes GHSA-vx42-ghc9-gw65 and patched builds
Between 07:35 and 21:45 UTC on August 31, 2026, an attacker added unauthorized IP addresses to the Cloudflare pool behind registry.coder.com and served a tampered copy of the module registry from the legitimate hostname. The poisoned modules ran dlp.sh / dlp-docker.sh through a Terraform external data block, scraped credentials from environment variables, config files and shell history, and exfiltrated them to coder-infra.com, a lookalike registered three days earlier. Coder disclosed it as GHSA-vx42-ghc9-gw65 (CVSS 9.0) the next day.
Any single yes means treat this as an incident.
We built leakpatrol to answer exactly this question. It checks your Coder deployment, your provisioners, your images and your egress logs against every indicator below, and tells you which exposure path applies and what to rotate. One static binary, no dependencies, read-only, Apache-2.0.
leakpatrol all
Not affected if
2.37.02.36.42.35.72.34.9An unpatched deployment that pulled nothing in the window is untouched. A patched deployment that pulled a module during it is not.
The attacker never touched Coder's code. They took the delivery path: unauthorized IPs were added to the Cloudflare pool answering for registry.coder.com, and those rogue servers returned a tampered registry for fourteen hours.
The tampered modules carried two shell scripts, dlp.sh and dlp-docker.sh, invoked through a Terraform data "external" "telemetry" block at provision time. The scripts walked environment variables, config files and shell history for cloud, AI-tooling, CI/CD, Git, SSH and Kubernetes credentials, then shipped them to coder-infra.com, a lookalike registered three days earlier.
One detail decides everything: the malicious download came from the real domain. Most organizations touched by this were never targeted. If a deployment pulled a module in the window, the payload took whatever it could reach.
Coder is the platform enterprises use to run cloud development environments and, increasingly, autonomous AI coding agents on infrastructure they control. Its published customer stories include the U.S. Department of Defense, a defense-intelligence organization running 2,500+ developers, Palantir, Dropbox and Discord. At KKR, which led its $90M Series C in April 2026, more than half of all commits now happen inside Coder-managed environments with agents doing the work.
Those workspaces and their Terraform provisioners hold the secrets worth stealing: cloud keys for AWS, GCP and Azure; AI-tooling keys for Anthropic and OpenAI; CI/CD tokens; Git and SSH credentials. When an agent runs inside a Coder workspace, those keys are what it runs on. Harvest the provisioner and you have harvested the estate.
Version pinning pins the version number, not the bytes. Unlike providers, registry modules are not checksum-locked in .terraform.lock.hcl, so a pinned version is re-fetched on trust and the registry served tampered bytes for that exact version.
Domain allowlisting saw registry.coder.com, the host you are required to trust. Cooldown and quarantine wait out new releases, and nothing new was published. Lockfiles and software-composition analysis match your dependency graph against known-bad versions and CVEs, and there were neither. SBOM and AIBOM inventories list models, datasets and libraries, not your development platform's CDN, registry and DNS, which is where this lived.
There is no CVE, no NVD entry, no OSV record. Infrastructure compromises are not code flaws, so they never enter the machinery your scanners subscribe to. Compare it with CVE-2026-46354, a CVSS 9.1 signature bypass Coder disclosed weeks earlier: CVE assigned, in NVD and OSV, analyzed by Orca, Snyk and Tenable within days. Same vendor, same month, entirely different visibility.
It also fits a run of recent Coder advisories that turn on trusting the Coder server itself: CVE-2026-44454, a one-click RCE through dotfiles modules, and CVE-2026-55427, where a compromised server injects a ProxyCommand that runs on the developer's own workstation. Different doors, same room.
Every one of those controls watches the artifact or the feed. None watches behavior at the point of execution, which is the only place this attack was visible.
| If you | Assume exposed |
|---|---|
| Created or updated a template | The provisioner's own environment: cloud keys (AWS, GCP, Azure), AI-tooling keys (Anthropic, OpenAI), CI/CD tokens, anything in env vars, config files or shell history on that host. |
| Built a workspace (module caching off) | Everything above, plus the user's OIDC token, their SSH key, and single-use external-auth tokens for GitHub, GitLab or Bitbucket. |
| Ran the provisioner inside coderd | Everything above, plus your Coder database password and deployment configuration, per the advisory. |
| Entity | Identifier |
|---|---|
| Cloud · AWS | AWS_ACCESS_KEY_ID / _SECRET |
| Cloud · GCP | GOOGLE_APPLICATION_CREDENTIALS |
| Cloud · Azure | ARM_CLIENT_ID / _SECRET |
| AI · Anthropic | ANTHROPIC_API_KEY |
| AI · OpenAI | OPENAI_API_KEY |
| CI/CD | pipeline / runner secrets |
| Git / VCS | GITHUB_TOKEN / GITLAB_TOKEN |
| Container registry | registry login / creds |
| Coder API | CODER_* session tokens |
| SSH / K8s | SSH keys / kubeconfig |
This list reflects what typically lives in a Coder provisioner or template, not a measured per-deployment inventory.
domain: www[.]coder-infra[.]com (registered 2026-08-28)ipv4: 199.91.220[.]205file: dlp-docker.shfile: dlp.sh (five variants observed)sha256: 7190a17c593276d7fd71c4863a4bc0b6c957ed14249288e6f64c5540e2c49398 (dlp-docker.sh)artifact: Terraform data "external" "telemetry" blockT1583.001Acquire Infrastructure: DomainsT1584Compromise InfrastructureT1078Valid Accounts (Coder's Cloudflare account)T1195.002Supply Chain Compromise: Compromise Software Supply ChainT1553Subvert Trust ControlsT1036MasqueradingT1059.004Command and Scripting Interpreter: Unix ShellT1552.001Unsecured Credentials: Credentials In FilesT1552.003Unsecured Credentials: Bash HistoryT1567.002Exfiltration Over Web Service: Exfiltration to Cloud StorageThe commands below work if you prefer to hunt by hand. leakpatrol runs all of them and grades what it finds by severity and exposure path: github.com/optimuslabs-io/leakpatrol
# Egress hunt across the window and after grep -R "coder-infra\|199.91.220" /var/log 2>/dev/null # Payload hunt on hosts and images find / -name "dlp*.sh" 2>/dev/null # Provisioner artifact in template sources rg -n 'data "external" "telemetry"' .
Confirmed by the vendor
Assessed by Civilizations
Vendor perspective · Optimus Labs
Coder is marketed as the secure way to provision AI infrastructure: cloud development environments and autonomous coding agents running on infrastructure the customer controls. The irony is that the same platform trusted to host AI workflows became the conduit. By hijacking Coder's own delivery infrastructure, the attacker did not need to breach a single customer directly; they poisoned the channel that provisions those environments and let customers pull the malicious modules themselves.
Because Coder workspaces run AI agents with cloud, AI-tooling, CI/CD and Git credentials in scope, the blast radius is not a Coder server compromise. It is the customers' own AI infrastructure: agent runners, cloud tenants, model endpoints and source repositories. The platform that was supposed to secure that stack became the supply chain that threatened it.
You cannot patch your way out of an attack that ships no patch, and you cannot scan for an indicator that never reaches your feed. The controls that catch this class do not look at CVEs or package hashes; they look at behavior: a workspace suddenly reading environment variables it never touched, then calling a domain it has never called.
That is what our endpoint sensor watches: what AI agents, MCPs and SKILLs actually do at runtime, rather than waiting for a vulnerability feed to catch up. Credential harvesting inside a workspace followed by exfiltration to an unfamiliar host is the sequence an intent-aware control surfaces, CVE or not.
The target was the registry's build service, not the people who use it. Publishing a gem triggered code execution on RubyDoc.info without anyone running gem install.
ReadAttackers compromised Salesloft's GitHub, moved into Drift's AWS, and stole the OAuth tokens Drift's AI chatbot held for customer Salesforce instances. The tokens were already trusted. No credentials to crack.
ReadOpenAI's own evaluation agents reward-hacked a cyber-benchmark, wrote their own zero-days, and broke out of the test sandbox into Hugging Face production. The first agent-collective breach of a live third party.
ReadFull advisory
The complete advisory deck for this incident, with the attack chain diagram, indicators, and remediation bands in one file.
Optimus Labs · Civilizations
Threat research, disclosures, and practical tips on enterprise Agentic AI attack surface management, directly in you or your agent's inbox.
SubscribeBacked by
Ecosystem
