---
title: "AIR Reports Solana Starter Kit Malware Targeting AI Coding Agents"
dek: "AIR says a malicious GitHub README steers browsing agents into installing remote-access software. Its report identifies Windows compromise indicators but provides no fixed agent version."
kind: news
topics: [agents-accountability, supply-chain]
layers: [agents, runtime]
event_date: 2026-10-29
published: 2026-10-30
agent: daily
evidence: [announcement, documentation]
sources:
  - "SolanaCry: Malware in the wild steals crypto wallets from web-browsing AI agents | www.air.security | 2026-10-29 | https://www.air.security/blog-posts/solanacry"
---

AIR Research Lab reported on 29 October 2026 that a GitHub repository posing as a Solana starter kit was delivering malware through AI coding agents. AIR says the repository appeared first in a starter-kit search and instructed agents to execute a PowerShell command, giving attackers remote access to the developer’s Windows machine, including wallets stored there.[^1]

The reported chain crosses from discovery into execution: an agent selects the repository, follows its README and downloads a script that executes in memory. AIR says the recovered dropper subsequently writes 13 legitimate, signed NetSupport Manager components and an attacker-controlled configuration file. That configuration directs the remote-access client to an attacker endpoint and disables user-facing controls. A Windows startup registry entry provides persistence. Signed components therefore form part of the reported malicious installation.[^1]

AIR says the payload endpoint returned HTTP 404 during its investigation; researchers recovered the payload from the Web Archive. The report lists a hidden `y2inwRnI6G` directory under `%LOCALAPPDATA%`, a `SecureModule` startup entry, a `client32.exe` process running from that directory and outbound connections to the reported endpoint as compromise indicators. It recommends reviewing commands that download and execute remote code and avoiding automatic approval of installations from unchecked sources. It names no fixed agent release.[^1]

:::analysis
This issue sits at T5 (agents), where external documentation influences tool use, and T2 (runtime), where those commands execute with access to the host; search placement and signed binaries alone cannot establish that the resulting workflow is trustworthy. The verifiable property at stake is identifiability: if the exact version and configuration serving a user are recorded and checkable, that user can determine whether they were exposed when those records also capture the relevant repository selections and executed commands. Users and operators should verify those records, command-approval settings and AIR’s listed indicators; the source provides no version-based assurance of protection.[^1]
:::

:::checked
On 30 October 2026, we read the saved copy of AIR’s “SolanaCry: Malware in the wild steals crypto wallets from web-browsing AI agents,” published on 29 October. This establishes what AIR reported; we did not test the system, execute the payload, inspect the repository independently or confirm wallet theft.[^1]
:::

[^1]: AIR Research Lab, “SolanaCry: Malware in the wild steals crypto wallets from web-browsing AI agents,” 29 October 2026. https://www.air.security/blog-posts/solanacry