GitHub

> **Malicious code was found in this repository and has been removed.** A supply-chain worm (a credential stealer) was hidden in core/telemetry/ from **August 2025** until **11 June 2026**. If you cloned and **ran** GPT Pilot from source during that window, **rotate your credentials** and read the security notice below.
🔒 Security notice
**What happened.** On **2025-08-24**, a malicious commit (065ee8eb, message *"Revert 'Implemented weekend discount'"*) was pushed to this repository, disguised as a routine revert. It was **publicly reported on 2026-06-08** by an external security researcher, and the malicious files were **removed on 2026-06-11**.
**What it did.** The commit added a hidden loader (core/telemetry/_hooks.py) that started automatically whenever the program ran (wired in through core/telemetry/__init__.py). That loader silently downloaded the Bun JavaScript runtime and used it to execute an obfuscated payload (core/telemetry/_runtime.bin). The payload is a *Shai-Hulud*-class supply-chain worm: it harvests credentials and secrets from the machine (cloud/AWS keys, GitHub and npm tokens, SSH keys, and similar) and can use the stolen access to spread to other projects.
**What this means for you.** The code only executed if GPT Pilot was actually **run** — simply having a copy you never ran is not affected. If you **cloned and ran** GPT Pilot from source between **August 2025 and 11 June 2026**, assume the payload may have executed on that machine and:
1. **Rotate every credential** that was present on the machine — GitHub/npm tokens, cloud/AWS keys, SSH keys, and API keys.
2. **Check for indicators of compromise:** the files core/telemetry/_runtime.bin, core/telemetry/_hooks.py, or core/telemetry/.loader.lock; an unexpected bun binary; or temporary folders named rt-*.
3. Treat the machine as potentially compromised until you have verified it is clean.
This repository is **no longer actively maintained**, which is why the malicious commit went unnoticed for an extended period. This notice and the file removals are a security cleanup, not a resumption of development.
---
🧑‍✈️ GPT PILOT 🧑‍✈️
---
---
GPT Pilot doesn't just generate code, it builds apps!
This repo is not being maintained anymore.
Visit Pythagora.ai for more info
---
)
(click to open the video in YouTube) (1:04min)
---
GPT Pilot is the core technology for the Pythagora VS Code extension that aims to provide **the first real AI developer companion**. Not just an autocomplete or a helper for PR messages but rather a real AI developer that can write full features, debug them, talk to you about issues, ask for review, etc.
---
📫 If you would like to get updates on future releases or just get in touch, join our Discord server or you can add your email here. 📬
---
* 🔌 Requirements
* 🚦How to start using gpt-pilot?
* 🔎 Examples
* 🐳 How to start gpt-pilot in docker?
* 🧑‍💻️ CLI arguments
* 🏗 How GPT Pilot works?
* 🕴How's GPT Pilot different from _Smol developer_ and _GPT engineer_?
* 🍻 Contributing
* 🔗 Connect with us
* 🌟 Star history
---
GPT Pilot aims to research how much LLMs can be utilized to generate fully working, production-ready apps while the developer oversees the implementation.
**The main idea is that AI can write most of the code for an app (maybe 95%), but for the rest, 5%, a developer is and will be needed until we get full AGI**.
If you are interested in our learnings during this project, you can check our latest blog posts.
---
**👉 Examples of apps written by GPT Pilot 👈**
---
🔌 Requirements
- **Python 3.9+**
🚦How to start using gpt-pilot?
👉 If you are using VS Code as your IDE, the easiest way to start is by downloading GPT Pilot VS Code extension. 👈