Clean GitHub repo tricks AI coding agents into running malware

Multiple active and evolving threats across software supply chains, phishing, and AI-assisted attack vectors were reported: CISA issued an urgent patch deadline for a Cisco Unified Communications Manager Server flaw being exploited in the wild; a supply‑chain injection stole ~$3M from Polymarket users; threat actors are using fraudulent OpenAI organization invites and abusing apps (Shop) to push callback phishing; Bluekit phishing-as-a-service added browser‑in‑the‑middle capabilities; Russian-linked actors are now stealing Signal backup recovery keys; a malicious GitHub repo can trick AI code‑