Threat
Meet Hades: The malware that lies to AI security agents
Publication date not yet evaluated · Added infoworld.com
Page published
Coverage timeline
Single-source incident — one report is available.
Why it matters
Defenders relying on LLM-based code analysis must recognize that malware can now actively deceive AI security agents via prompt injection, undermining automated detection in software supply chains.
StepSecurity researchers uncovered the Hades Campaign, a sophisticated supply-chain compromise targeting Python developer environments via infected packages (including ensmallen). The self-propagating worm extracts sensitive data, moves laterally, and notably uses adversarial prompt injection to trick LLM-based code analysis/AI gatekeeper systems into overlooking its malicious payloads. It is described as the latest evolution of the Miasma threat actor.