An attacker deployed a self‑spreading worm across approximately 100 internal code repositories after hijacking an active AI coding‑assistant session, according to Mandiant.
Sequence of actions observed inside the compromised AI‑assisted session
Mandiant’s September 2026 case study traces a compact chain of events that began when an AI coding assistant recommended third‑party software that had been poisoned and the developer accepted the suggestion. After that acceptance, Mandiant reports the following actions:
- The attacker used the developer’s active AI assistant session to install an infostealer via a poisoned PyPI package.
- The attacker exfiltrated GitHub OAuth tokens from the environment.
- With those tokens and the foothold established, the attacker deployed a self‑spreading worm called Shai‑Hulud across roughly 100 internal code repositories.
- The worm stole repository secrets and source code for the company’s products.
- The attacker also poisoned a package in the company’s official namespace; when another employee pulled the compromised version, that action produced a second infection.
Shai‑Hulud worm: repository spread and direct impacts
Mandiant’s public case study highlights Shai‑Hulud’s operational goals inside the breached environment: broad lateral movement through internal code repositories and the harvesting of secrets and product source code. The spread touched on the company’s official package namespace, producing a second infection when an internal developer pulled the poisoned package. The report does not identify the software‑as‑a‑service provider by name.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scramblePoisoned dependencies, OAuth tokens, and the role of extensions
Central to the incident was a poisoned dependency delivered through PyPI that carried an infostealer. Mandiant also documents theft of long‑lived credentials — specifically GitHub OAuth tokens — which the attacker leveraged to move and propagate inside source control. The report further notes that the initial compromise stemmed from an AI assistant recommendation that suggested the poisoned package; the public write‑up does not disclose how or when the attacker initially took over the active coding‑assistant session.
Recent Shai‑Hulud‑family activity and separate campaigns
Mandiant contextualizes this incident within a larger set of malicious activity targeting developer tools and credentials. In August, a Keyv‑linked npm worm poisoned hundreds of packages and planted hooks for Claude Code and Visual Studio Code. A later analysis of related activity found a Shai‑Hulud variant scanning 469 locations for credentials across developer systems, CI/CD tools, cloud configurations, and AI tool files. Mandiant’s case study describes those August campaigns as separate and states that the available evidence does not link them to the unnamed intrusion it documents.
Mandiant’s three recommended controls for AI‑assisted development
- Check AI‑recommended third‑party dependencies against cryptographic checksums and approved allowlists.
- Keep raw API keys, long‑lived OAuth tokens, and other secrets out of direct reach of extensions.
- Route dependency traffic through controlled internal repositories.
What this means for security teams, enterprise developers, and procurement leaders
- Security teams: Expect to treat AI coding assistants as an extension of the software supply chain and prioritize controls that validate recommended dependencies and block extensions from accessing raw secrets.
- Enterprise developers: Be cautious about accepting dependency suggestions from AI assistants without checksum verification or allowlist checks; pulling packages from internal, controlled repositories reduces blast radius.
- Procurement leaders: Include runtime and extension constraints in procurement terms for AI‑assisted development tools so that vendors enable checksum verification, allowlists, and routing through internal repositories.
Mandiant frames this incident against a broader trend it first flagged in March 2026: attackers shifted during 2025 from using generative AI mainly to speed up work toward weaponizing large language models in malware and active operations. The September case study documents one concrete outcome of that evolution — a poisoned recommendation inside an active AI session that led to credential theft, a self‑spreading worm, and exfiltration of source code and secrets — while the report’s public form leaves a critical procedural detail unspecified: when and how the attacker initially took over the active coding‑assistant session.
