At least strong evidence it happened once: https://niconiconi.neocities.org/posts/ken-thompson-really-did-launch-his-trusting-trust-trojan-attack-in-real-life/

At least strong evidence it happened once: https://niconiconi.neocities.org/posts/ken-thompson-really-did-launch-his-trusting-trust-trojan-attack-in-real-life/ https://niconiconi.neocities.org/posts/ken-thompson-really-d... With careful planning though, with the ability to rootkit any linux kernel it compiles that in turn hot-patches any gcc compilations and so on, with the ability to re-route system calls to hide itself... it could be very very hard to detect. Even moreso if such was deployed in a couple target CI/CD systems. bootstrappable builds are the only path to prove such an attack did not happen.