Attacker Hijacks AI Coding Assistant, Deploys Worm Across 100 Repos

First Documented AI Assistant Session Hijack

An attacker successfully compromised an active AI coding assistant session at a software-as-a-service company, then used that access to deploy the Shai-Hulud worm across approximately 100 internal code repositories, according to a new case study from Mandiant.

The intrusion represents the first publicly documented instance of an adversary taking direct control of an AI assistant during an active development session. The attack chain began when the compromised assistant recommended software that the attacker had already poisoned. A developer accepted the recommendation, triggering a cascade of further compromises.

How the Compromise Escalated

Once the poisoned recommendation was accepted, the attacker leveraged the developer's active session to install an information-stealing tool through a malicious PyPI package. The adversary also exfiltrated GitHub OAuth tokens during this phase.

With those credentials in hand, the attacker deployed Shai-Hulud, a self-propagating worm, which spread laterally across the company's internal repository infrastructure. The worm's payload included capabilities to steal repository secrets and source code for the company's products.

The attack didn't stop there. The adversary also poisoned a package within the company's official namespace. When another employee pulled what appeared to be a legitimate internal dependency, a second infection occurred, demonstrating how supply chain attacks can exploit trusted internal sources.

Why It Matters

This case marks an inflection point in how AI development tools create new attack surfaces. As organizations rapidly adopt AI coding assistants to accelerate development, they're introducing systems that operate with broad access to code, credentials, and infrastructure—without the security controls traditionally applied to human developers. The attack shows adversaries have moved beyond simply using AI to write better phishing emails; they're now actively exploiting the trust relationships between developers and their AI tools. For security teams, this means rethinking access controls, session management, and dependency validation in AI-assisted workflows.

Defensive Measures for AI-Assisted Development

Mandiant outlined three specific controls organizations should implement to protect AI-assisted development environments:

First, validate all AI-recommended third-party dependencies against cryptographic checksums and maintain approved allowlists before installation. This prevents poisoned packages from entering the environment even when recommended by a compromised or manipulated assistant.

Second, isolate sensitive credentials from direct extension access. Raw API keys, long-lived OAuth tokens, and other secrets should be stored in secure vaults rather than locations where browser extensions or AI tools can directly read them.

Third, route all dependency traffic through controlled internal repositories rather than allowing direct pulls from public package registries. This creates a checkpoint where security teams can scan and validate packages before they reach developer environments.

Broader Pattern of AI Tool Targeting

The Mandiant case appears in the firm's September 2026 report, though the document doesn't specify when the intrusion occurred or precisely how the attacker initially gained control of the coding assistant session.

This incident fits within a broader pattern of attacks targeting developer tools and AI assistants. In August, a separate campaign linked to Keyv compromised hundreds of npm packages and planted hooks specifically designed to target Claude Code and Visual Studio Code. Subsequent analysis uncovered a Shai-Hulud variant that scanned 469 different locations for credentials across developer systems, CI/CD pipelines, cloud configurations, and AI tool configuration files.

Mandiant noted in a March 2026 report that attackers had evolved their use of AI throughout 2025, moving from primarily using generative AI to accelerate existing workflows to actively incorporating large language models into malware and live attack operations.

The details of this attack were first reported by Mandiant in their September 2026 threat intelligence report.