Attacker Hijacks AI Coding Assistant Session, Spreads Shai-Hulud Across About 100 Repositories
Mandiant says an attacker hijacked an AI coding-assistant session at a SaaS provider and spread the Shai-Hulud worm across roughly 100 repositories, stealing secrets.
Mandiant's September 2026 report describes an attacker hijacking an active AI coding-assistant session at an unnamed SaaS provider, then getting a poisoned package recommendation accepted and installing an infostealer via a malicious PyPI package. The attacker stole GitHub OAuth tokens, deployed the self-spreading Shai-Hulud worm across approximately 100 internal repositories, and stole repository secrets and product source code. Poisoning a package in the company's official namespace caused a second employee to pull the compromised version and become infected. Mandiant recommends verifying AI-recommended dependencies against checksums and allowlists, keeping secrets out of extension reach, and routing dependency traffic through internal repositories.
- Attacker hijacked an active AI coding-assistant session at an unnamed SaaS provider
- Poisoned PyPI package delivered an infostealer; GitHub OAuth tokens were stolen
- Shai-Hulud worm spread across about 100 internal repos, stealing secrets and source code
- Compromised official-namespace package caused a second infection at the same company
- Separate Shai-Hulud campaigns scanned 469 locations for credentials across developer systems
Full article346 words · extracted from thehackernews.com · click to collapse
Swati KhandelwalSep 16, 2026Artificial Intelligence / Software Security
Mandiant says an attacker hijacked an active AI coding-assistant session at an unnamed software-as-a-service provider and later spread Shai-Hulud across about 100 internal code repositories.
Before the repository spread, the assistant recommended software that the attacker had poisoned, and the recommendation was accepted. The worm stole repository secrets and source code for the company's products.
The case appears in Mandiant's September 2026 report. The public case study does not say when the intrusion happened or how the attacker took over the active coding-assistant session.
How the Attack Unfolded
After the recommendation was accepted, the attacker used the developer's active session to install an infostealer through a poisoned PyPI package. The attacker also stole GitHub OAuth tokens.
The attacker then deployed the self-spreading Shai-Hulud worm across approximately 100 internal code repositories.
The attacker also poisoned a package in the company's official namespace. Another employee pulled the compromised version, causing a second infection.
Mandiant had already documented attackers using AI in real attacks. In a March 2026 report, it said attackers had moved during 2025 from using generative AI mainly to speed up work to using large language models in malware and active attacks.
How Defenders Can Protect AI-Assisted Development
For this case, Mandiant recommends three controls for AI-assisted development:
- Check AI-recommended third-party dependencies against cryptographic checksums and approved allowlists.
- Keep raw API keys, long-lived OAuth tokens, and other secrets out of direct reach of extensions.
- Route dependency traffic through controlled internal repositories.
Recent Shai-Hulud-family attacks have also targeted developer tools and credentials. In August, a Keyv-linked npm worm poisoned hundreds of packages and planted hooks for Claude Code and Visual Studio Code, while a later analysis found a Shai-Hulud variant scanning 469 locations for credentials across developer systems, CI/CD tools, cloud configurations, and AI tool files.
These were separate campaigns, and the available evidence does not link them to the unnamed Mandiant intrusion.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2026/09/attacker-hijacks-ai-coding-assistant.html