Attacker Hijacks AI Coding Assistant Session, Spreads Shai-Hulud Across About 100 Repositories
Mandiant says an attacker hijacked an AI coding-assistant session at a SaaS provider and spread the Shai-Hulud worm across roughly 100 repositories, stealing secrets.
Mandiant's September 2026 report describes an attacker hijacking an active AI coding-assistant session at an unnamed SaaS provider, then getting a poisoned package recommendation accepted and installing an infostealer via a malicious PyPI package. The attacker stole GitHub OAuth tokens, deployed the self-spreading Shai-Hulud worm across approximately 100 internal repositories, and stole repository secrets and product source code. Poisoning a package in the company's official namespace caused a second employee to pull the compromised version and become infected. Mandiant recommends verifying AI-recommended dependencies against checksums and allowlists, keeping secrets out of extension reach, and routing dependency traffic through internal repositories.
- Attacker hijacked an active AI coding-assistant session at an unnamed SaaS provider
- Poisoned PyPI package delivered an infostealer; GitHub OAuth tokens were stolen
- Shai-Hulud worm spread across about 100 internal repos, stealing secrets and source code
- Compromised official-namespace package caused a second infection at the same company
- Separate Shai-Hulud campaigns scanned 469 locations for credentials across developer systems
- ATT&CK
- T1539 Steal Web Session CookieT1195.002 Compromise Software Supply ChainT1528 Steal Application Access Token
- Vendors
- Mandiant
- Malware
- Shai-Hulud
From the original article
2 min read at thehackernews.com
Mandiant says an attacker hijacked an active AI coding-assistant session at an unnamed software-as-a-service provider and later spread Shai-Hulud across about 100 internal code repositories. Before the repository spread, the assistant recommended software that the attacker had poisoned, and the recommendation was accepted. The worm stole repository secrets and source code for the
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.