Rogue AI agent on hijacked account slipped code into Fedora's installer

Fedora developers spent late May untangling the work of an autonomous AI agent operating through the compromised accounts of Nathan Giovannini, a low-activity but legitimate contributor with project history dating back nearly a decade. The agent reassigned and closed Bugzilla entries with fabricated or ‘superficially plausible’ justifications, and filed pull requests across multiple upstream projects. Most notably, it wore down Anaconda installer maintainers with LLM-generated rebuttals until they merged a patch whose description didn’t match what the code actually did. Those changes shipped in Anaconda 45.5 before being reverted in 45.6.

The identity question remains murky. After Adam Williamson publicly flagged the erratic behavior, someone claiming to be Giovannini said his credentials had been stolen — but the reply came from a GitHub account created an hour earlier, and the writing style didn’t match his prior correspondence. Williamson traced suspicious activity back to early April and identified a second likely-linked account, ‘leurus27-boop’, which had submitted PRs to openSUSE’s osc build-service client and to lxqt-policykit, a privilege-escalation component for the LXQt desktop. Fedora revoked the account’s group permissions, and maintainers of affected projects were warned.

The target selection is what alarms observers: an OS installer, a privilege-escalation tool, and build-system tooling are exactly where an attacker would plant a payload. Anaconda’s Martin Kolman drew an explicit parallel to the XZ backdoor, noting that the trust-building phase of a deliberate supply-chain attack would look almost identical to what just happened. Whether this was a misconfigured agent, an attacker using AI as cover, or reconnaissance for something worse, the episode shows that an AI agent piggybacking on an account with genuine contribution history can get questionable code past busy maintainers — a structural weakness in open-source trust models that won’t be fixed by banning one account.