{"repo":"Pythagora-io/gpt-pilot","free":true,"listed":false,"github":"https://github.com/Pythagora-io/gpt-pilot","clone":"git clone https://github.com/Pythagora-io/gpt-pilot.git","description":"The first real AI developer","language":"Python","stars":33696,"topics":["ai","codegen","developer-tools","gpt-4","coding-assistant","research-project"],"license":null,"category":"dev-tools","readme_excerpt":"[!CAUTION] Malicious code was found in this repository and has been removed. A supply-chain worm (a credential stealer) was hidden in core/telemetry/ from August 2025 until 11 June 2026 . If you cloned and ran GPT Pilot from source during that window, rotate your credentials and read the security notice below. 🔒 Security notice What happened. On 2025-08-24 , a malicious commit ( 065ee8eb , message \"Revert 'Implemented weekend discount'\" ) was pushed to this repository, disguised as a routine revert. It was publicly reported on 2026-06-08 by an external security researcher, and the malicious files were removed on 2026-06-11 . What it did. The commit added a hidden loader ( core/telemetry/ hooks.py ) that started automatically whenever the program ran (wired in through core/telemetry/ init .py ). That loader silently downloaded the Bun JavaScript runtime and used it to execute an obfuscated payload ( core/telemetry/ runtime.bin ). The payload is a Shai-Hulud -class supply-chain worm: it harvests credentials and secrets from the machine (cloud/AWS keys, GitHub and npm tokens, SSH keys, and similar) and can use the stolen access to spread to other projects. What this means for you. The code only executed if GPT Pilot was actually run — simply having a copy you never ran is not affected. If you cloned and ran GPT Pilot from source between August 2025 and 11 June 2026 , assume the payload may have executed on that machine and: 1. Rotate every credential that was present on the mac","default_branch":null,"files":null,"tree":[],"storefront":"/r/Pythagora-io","claimed":false,"request_supported":{"post":"https://gitbuyer.com/r/Pythagora-io/gpt-pilot/request-supported","requests":0},"note":"indexed from public GitHub; nothing is for sale on this page. Clone it from GitHub. Paid listings live at /search."}