[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f9FmjAhIbacit0U8po4eyqEB2JhDC0zMSrjMkuyXIxz0":3},{"article":4,"iocs":54},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"full_text":11,"url":12,"image_url":13,"published_at":14,"ingested_at":15,"relevance_score":16,"entities":17,"category_id":31,"category":32,"article_tags":36},"c974bdb0-2425-4046-b4df-dfff63c0b20a","Attacker Hijacks AI Coding Assistant Session, Spreads Shai-Hulud Across About 100 Repositories","attacker-hijacks-ai-coding-assistant-session-spreads-shai-hulud-across-about-100-ffa867","Mandiant says an attacker hijacked an active AI coding-assistant session at an unnamed software-as-a-service provider and later spread Shai-Hulud across about 100 internal code repositories. Before the repository spread, the assistant recommended software that the attacker had poisoned, and the recommendation was accepted. The worm stole repository secrets and source code for the","An attacker hijacked an active AI coding assistant session at an unnamed SaaS provider, leading to the spread of the Shai-Hulud worm across approximately 100 internal code repositories. The attacker poisoned a PyPI package, which was then recommended and accepted by the AI assistant, allowing the attacker to install an infostealer and steal secrets and source code. The worm subsequently spread, and a poisoned package in the company's official namespace caused a second infection.","Attacker hijacks AI coding assistant session, spreads Shai-Hulud worm across ~100 repositories.","Attacker Hijacks AI Coding Assistant Session, Spreads Shai-Hulud Across About 100 Repositories Swati KhandelwalSep 16, 2026Artificial Intelligence \u002F Software Security Mandiant says an attacker hijacked an active AI coding-assistant session at an unnamed software-as-a-service provider and later spread Shai-Hulud across about 100 internal code repositories. Before the repository spread, the assistant recommended software that the attacker had poisoned, and the recommendation was accepted. The worm stole repository secrets and source code for the company's products. The case appears in Mandiant's September 2026 report. The public case study does not say when the intrusion happened or how the attacker took over the active coding-assistant session. How the Attack Unfolded After the recommendation was accepted, the attacker used the developer's active session to install an infostealer through a poisoned PyPI package. The attacker also stole GitHub OAuth tokens. The attacker then deployed the self-spreading Shai-Hulud worm across approximately 100 internal code repositories. The attacker also poisoned a package in the company's official namespace. Another employee pulled the compromised version, causing a second infection. Mandiant had already documented attackers using AI in real attacks. In a March 2026 report, it said attackers had moved during 2025 from using generative AI mainly to speed up work to using large language models in malware and active attacks. How Defenders Can Protect AI-Assisted Development For this case, Mandiant recommends three controls for AI-assisted development: Check AI-recommended third-party dependencies against cryptographic checksums and approved allowlists. Keep raw API keys, long-lived OAuth tokens, and other secrets out of direct reach of extensions. Route dependency traffic through controlled internal repositories. Recent Shai-Hulud-family attacks have also targeted developer tools and credentials. In August, a Keyv-linked npm worm poisoned hundreds of packages and planted hooks for Claude Code and Visual Studio Code, while a later analysis found a Shai-Hulud variant scanning 469 locations for credentials across developer systems, CI\u002FCD tools, cloud configurations, and AI tool files. These were separate campaigns, and the available evidence does not link them to the unnamed Mandiant intrusion. Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. SHARE     Tweet Share Share Share SHARE  artificial intelligence, Malware, Software Security, Supply Chain ⚡ Top Stories This Week OpenAI Agents Linked to RubyGems Campaign That Gained RCE on RubyDoc Servers GitLab CVSS 10 File-Read Flaw Draws In-the-Wild Probes After Disclosure Claude Used to Automate Exploitation and Data Theft Across Multiple Victims Attackers Chain JFrog Artifactory Flaws to Gain Admin Control and Plant Backdoors PaperCut Replaces Emergency Patches With Fixes for Two Actively Exploited Flaws Cisco FMC Flaws Exploited to Steal Credentials and Deploy Qilin Ransomware ThreatsDay: 200 Android Flaws, Browser-Built Phishing, 119K Scam Shops + 23 More Stories Check Point Discloses Two 9.8-Rated VPN Certificate Flaws Enabling Unauthenticated RCE Anthropic Discloses Fourth AI Hacking Incident Involving Claude Opus 4.6 Four Spy Groups Used the Same Chrome and Windows Exploit Kit Within a Week DeepSeek Harness Flaw Let AI Agents Disable Their Own File Sandbox Without Approval Chrome V8 Zero-Day Exploited in the Wild Enables Code Execution Inside Sandbox New cPanel Flaw Lets a Hosting Account With Mail Privileges Run Code as Root F5 BIG-IP APM Malware Injects a PHP Web Shell Into Memory, Evading Disk Scans Researcher Drops New Microsoft Defender PoC Showing ShieldBreak Patch Can Be Bypassed Microsoft Patches Record 974 Flaws, Including Two Exploited Windows Zero-Days ChatGPT Flaw Let a Planted Prompt Send a Victim's Gmail Data to Another Account WeChat Zero-Click Worm Took Over Accounts on iPhone and Android via Incoming Calls Fake IT Calls Target Executives in Microsoft 365 Data Theft and Extortion Attacks When the Whole Company Adopts AI: What It Does to Your SOC Your Critical Vulnerabilities Might Not Be Your Biggest Risk What It Took to Reach 1 Billion Build Manifests US Becomes Top Target in RMM Phishing Campaign Spanning 46 Countries Why Are So Many Security Professionals Keeping Breaches Quiet? The Economics of Dwell Time and Why AI Native SIEM Changes the Equation ⭐ Featured Resources Get the eBook: Map Enterprise AI Risk Across the Full Lifecycle Give SOC Analysts Visibility Into 90% of Attacks Within 60 Seconds Benchmark Your SOC's AI Adoption With the 2026 Security Operations Report Register for LDR516: Strategic Vulnerability and Threat Management at SANS DC Metro","https:\u002F\u002Fthehackernews.com\u002F2026\u002F09\u002Fattacker-hijacks-ai-coding-assistant.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEghZsSi9JbsiALEhfWv_49vjKw2uHa-lBOUWCwhyphenhyphensppIZLuNgoQ-VQTs2EjRmXjemfvM0Fj9knUSdDIYbSWg5Pf_sqKBOGV5BA67GVYn_lNreIN_Kwpp3u0yxKgF4dIHXRj-NKcCyimE0kwHUWHqxP7SHUd-Tu31S3jfzxOPmN8_Xk8d5GYRce2N4MdmYY\u002Fs1600\u002Fshai.jpg","2026-09-16T13:37:07+00:00","2026-09-16T16:00:11.978575+00:00",8,[18,21,24,27,29],{"name":19,"type":20},"Shai-Hulud","threat_actor",{"name":22,"type":23},"PyPI","product",{"name":25,"type":26},"AI coding assistant","technology",{"name":28,"type":26},"generative AI",{"name":30,"type":26},"large language models","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":31,"icon":33,"name":34,"slug":35},null,"Malware","malware",[37,42,47,49],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":43},{"id":44,"icon":33,"name":45,"slug":46},"839da5c1-3c34-47e2-9499-f7201640e3ac","AI Security","ai-security",{"category":48},{"id":31,"icon":33,"name":34,"slug":35},{"category":50},{"id":51,"icon":33,"name":52,"slug":53},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[55,57],{"type":35,"value":19,"context":56},"Self-spreading worm used in the attack",{"type":35,"value":58,"context":59},"infostealer","Type of malware installed by the attacker"]